CVE-2026-23846

CVE-2026-23846 affects Tugtainer, a self-hosted application for automating updates of Docker containers, in versions prior to 1.16.1. The vulnerability stems from the password authentication mechanism transmitting credentials via URL query parameters rather than in the HTTP request body. This design flaw results in passwords being logged in server access logs and potentially exposed through browser history, Referer headers, and proxy logs, corresponding to CWE-598 (Information Exposure Through Query Parameters in GET Request). The issue carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).

Attackers can exploit this vulnerability over the network with low complexity and no required privileges, though it necessitates user interaction, such as a legitimate user authenticating via the affected interface. Exploitation enables observation or access to logs, browser data, or network traffic where the password is inadvertently stored or transmitted. Successful compromise yields high confidentiality and integrity impacts, allowing attackers to capture valid credentials for unauthorized access to Tugtainer instances.

The GitHub security advisory (GHSA-f2qf-f544-xm4p) and patching commit (9d23bf40ac1d39005582abfcf0a84753a4e29d52) confirm that upgrading to version 1.16.1 resolves the issue by modifying the authentication to avoid query parameter usage. Security practitioners should prioritize updating affected Tugtainer deployments and review existing logs for exposed credentials.