CVE-2026-23846

Katalog CVE

CVSS 9.1 · Critical EPSS 0,47%

Kerentanan Use of HTTP Request With Sensitive Query String pada quenary tugtainer. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server access logs and potentially exposed through browser history, Referer headers, and proxy logs. Version 1.16.1 patches the issue.

Rincian

Terbit di NVD

19 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-598: Use of HTTP Request With Sensitive Query String

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 38,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Quenary/tugtainer/security/advisories/GHSA-f2qf-f544-xm4p exploit · advisory vendor
• https://github.com/Quenary/tugtainer/commit/9d23bf40ac1d39005582abfcf0a84753a4e29d52 patch