How severe is CVE-2026-23846?

CVE-2026-23846 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability none.

Is CVE-2026-23846 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (32nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-23846?

CVE-2026-23846 affects Quenary Tugtainer. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-23846?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2026-23846 have an EU (EUVD) identifier?

Yes. CVE-2026-23846 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-3294.

When was CVE-2026-23846 published?

CVE-2026-23846 was published on 2026-01-19 and last updated on 2026-06-17.

CVE-2026-23846

CVE-2026-23846 is a high-severity vulnerability in Quenary Tugtainer with a CVSS 3.x base score of 8.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-598.

Key facts

Severity: High (CVSS 3.x base score 8.1)
EPSS exploit prediction: 0% (32nd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-3294
Weakness: CWE-598
Affected product: Quenary Tugtainer
Published: 2026-01-19
Last modified: 2026-06-17

Description

Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server access logs and potentially exposed through browser history, Referer headers, and proxy logs. Version 1.16.1 patches the issue.

Frequently asked questions

What is CVE-2026-23846?: Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server access logs and potentially exposed through browser history, Referer headers, and proxy logs. Version 1.16.1 patches the issue.
How severe is CVE-2026-23846?: CVE-2026-23846 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2026-23846 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (32nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-23846?: CVE-2026-23846 affects Quenary Tugtainer. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-23846?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-23846 have an EU (EUVD) identifier?: Yes. CVE-2026-23846 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-3294.
When was CVE-2026-23846 published?: CVE-2026-23846 was published on 2026-01-19 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:quenary:tugtainer:*:*:*:*:*:docker:*:*

More vulnerabilities in Quenary Tugtainer

CVE-2025-69201 — Critical (CVSS 9.8): Tugtainer is a self-hosted app for automating updates of docker containers. In versions prior to 1.15.1, arbitary…

All CVEs affecting Quenary Tugtainer →

Other CWE-598 vulnerabilities

CVE-2025-69270 — Critical (CVSS 9.8): Information Exposure Through Query Strings in GET Request vulnerability in Broadcom DX NetOps Spectrum on Windows,…
CVE-2023-6014 — Critical (CVSS 9.8): An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment.
CVE-2025-56551 — High (CVSS 8.2): An issue in DirectAdmin v1.680 allows unauthorized attackers to manipulate the page layout and replace the legitimate…
CVE-2021-21594 — High (CVSS 8.2): Dell PowerScale OneFS versions 8.2.2 - 9.1.0.x contain a use of get request method with sensitive query strings…
CVE-2019-6531 — High (CVSS 8.1): An attacker could retrieve passwords from a HTTP GET request from the Kunbus PR100088 Modbus gateway versions prior to…
CVE-2026-58656 — High (CVSS 7.5): Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with…

Browse all CWE-598 vulnerabilities →