Quenary

Tugtainer

7 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.1

CVE-2026-87004

  • EPSS 0.34%
  • Veröffentlicht 30.09.2026 17:01:24
  • Zuletzt bearbeitet 30.09.2026 19:57:08

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, when the OIDC login flow completes, backend/modules/auth/providers/auth_oidc_provider.py decodes the id_token returned by the identity provider's tok...

9.1

CVE-2026-62308

  • EPSS 0.35%
  • Veröffentlicht 30.09.2026 16:59:31
  • Zuletzt bearbeitet 30.09.2026 20:17:34

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notificatio...

9.8

CVE-2026-55494

  • EPSS 0.64%
  • Veröffentlicht 30.09.2026 16:58:27
  • Zuletzt bearbeitet 30.09.2026 19:57:08

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENT_SECRET is not configured. The Agent uses request signatures to pro...

9.4

CVE-2026-55181

  • EPSS 0.6%
  • Veröffentlicht 30.09.2026 16:57:15
  • Zuletzt bearbeitet 30.09.2026 20:17:33

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDC_ENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is d...

9.9

CVE-2026-47752

  • EPSS 0.39%
  • Veröffentlicht 23.07.2026 16:57:54
  • Zuletzt bearbeitet 23.07.2026 18:23:01

Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection (SSTI) in the notification template feature. The `title_template` and `body_template` fields are ren...

9.1

CVE-2026-23846

Exploit
  • EPSS 0.41%
  • Veröffentlicht 19.01.2026 19:42:35
  • Zuletzt bearbeitet 05.02.2026 18:44:54

Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be ...

9.8

CVE-2025-69201

  • EPSS 0.41%
  • Veröffentlicht 29.12.2025 15:51:41
  • Zuletzt bearbeitet 07.10.2026 12:10:00

Tugtainer is a self-hosted app for automating updates of docker containers. In versions prior to 1.15.1, arbitary arguments can be injected in tugtainer-agent `POST api/command/run`. Version 1.15.1 fixes the issue.