CVE-2026-23846 affects Tugtainer, a self-hosted Docker container updater, in versions up to 1.16.0. Its password login sent the password in the URL query string, so it landed in access logs, browser history and Referer headers. The CVSS score is 8.1. Version 1.16.1 fixes it. Upgrade and rotate the password.
What's affected
Tugtainer versions before 1.16.1. The GitHub advisory lists 1.16.0 and earlier as affected and 1.16.1 as patched.
How to check if you're exposed
Check the image tag or version your instance runs:
docker ps --format "table {{.Names}}\t{{.Image}}"
docker image ls | grep -i tugtainer
If the tag is below 1.16.1, you are affected. Then think about where the password may already be stored: reverse proxy access logs, load balancer logs, log shippers and browser history on admin machines.
What to do now
- Upgrade Tugtainer to 1.16.1 or later.
- Change the Tugtainer password. Assume the old one is in any log that recorded login requests.
- Search your proxy and application logs for login requests that carry the password in the query string, and purge or restrict those logs.
- If Tugtainer is exposed to a wider network than it needs, put it behind a VPN or an allowlist.
Why it matters
Query strings are logged almost everywhere by default: web servers, proxies, CDNs, browser history and analytics. Request bodies usually are not. That is why CWE-598, sensitive data in a GET request query string, is its own weakness class.
The impact is not only a vulnerable app. It is that a secret ends up in many places that have different access controls than the app. A Docker updater is also a powerful tool, because it can pull and restart your containers. The record does not list this CVE as known exploited.
Reading the severity score
The record gives a CVSS base score of 8.1, published 2026-01-19. In the vector, the attacker works over the network, needs no account, and the attack is low in complexity. User interaction is required. Impact on confidentiality is high, on integrity high and on availability no.
A base score describes the flaw in general, not your risk. Weigh it against how exposed your instance is and what it can reach. The Gold page for the CVE keeps the score, weakness and references together.
Quick check
Is upgrading enough?
Not on its own. The fix stops new passwords from leaking, but old logs may still hold the previous one. Change the password and clean up the logs.
Sources
Last reviewed: 19 October 2026.
