Quenary Tugtainer vulnerabilities

CVE-2026-47752 [CRITICAL] CWE-1336 CVE-2026-47752: Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection (SSTI) in the notification template feature. The `title_template` and `body_template` fields are rendered using an unsandboxed `jinja2.Environment`, allowing any authenticated user to execute arbitr

CVE-2026-55181 [CRITICAL] CWE-284 CVE-2026-55181: Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDC_ENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. However, a direct request to /auth/oidc/login still starts the OIDC login flow, returns HT

CVE-2026-55494 [CRITICAL] CWE-284 CVE-2026-55494: Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENT_SECRET is not configured. The Agent uses request signatures to protect its API routes. However, in agent/auth.py, the signature verification function returns success

CVE-2026-23846 [CRITICAL] CWE-598 CVE-2026-23846: Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.1 Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server access logs and potentially exposed through browser history, Referer headers, and

CVE-2026-62308 [CRITICAL] CWE-918 CVE-2026-62308: Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/test_notification endpoint accepts a urls field and passes it direct

CVE-2025-69201 [CRITICAL] CWE-77 CVE-2025-69201: Tugtainer is a self-hosted app for automating updates of docker containers. In versions prior to 1.1 Tugtainer is a self-hosted app for automating updates of docker containers. In versions prior to 1.15.1, arbitary arguments can be injected in tugtainer-agent `POST api/command/run`. Version 1.15.1 fixes the issue.

CVE-2026-87004 [HIGH] CWE-347 CVE-2026-87004: Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, when the OIDC login flow completes, backend/modules/auth/providers/auth_oidc_provider.py decodes the id_token returned by the identity provider's token endpoint using jose.jwt.get_unverified_claims() instead of jwt.decode(). This skips signature verifi