CVE-2026-23846

HighPublic PoC

Published: 19 January 2026

Published

19 January 2026

Modified

05 February 2026

KEV Added

—

Patch

—

CVSS Score 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS Score 0.0012 30.4th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-23846 is a high-severity Use of GET Request Method With Sensitive Query Strings (CWE-598) vulnerability in Quenary Tugtainer. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked at the 30.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 IA-5 (Authenticator Management) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Credentials In Files (T1552.001) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mitigates the CVE by requiring timely identification, prioritization, and correction of the specific flaw through patching to version 1.16.1.

IA-5 Authenticator Management good match

prevent

Requires protecting authenticator content like passwords from unauthorized disclosure, prohibiting transmission via insecure URL query parameters.

SC-8 Transmission Confidentiality and Integrity partial match

prevent

Mandates cryptographic protection for transmitted sensitive information such as credentials, reducing exposure risks in network traffic, Referer headers, and proxies.

MITRE ATT&CK Enterprise TechniquesAI

T1552.001 Credentials In Files Credential Access

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.

attack.mitre.org →

T1555.003 Credentials from Web Browsers Credential Access

Adversaries may acquire credentials from web browsers by reading files specific to the target browser.

attack.mitre.org →

Why these techniques?

The vulnerability exposes credentials in server access logs (T1552.001: Credentials in Files) and browser history (T1555.003: Credentials from Web Browsers), facilitating unauthorized credential access.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server…

access logs and potentially exposed through browser history, Referer headers, and proxy logs. Version 1.16.1 patches the issue.

Deeper analysisAI

CVE-2026-23846 affects Tugtainer, a self-hosted application for automating updates of Docker containers, in versions prior to 1.16.1. The vulnerability stems from the password authentication mechanism transmitting credentials via URL query parameters rather than in the HTTP request body. This design flaw results in passwords being logged in server access logs and potentially exposed through browser history, Referer headers, and proxy logs, corresponding to CWE-598 (Information Exposure Through Query Parameters in GET Request). The issue carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).

Attackers can exploit this vulnerability over the network with low complexity and no required privileges, though it necessitates user interaction, such as a legitimate user authenticating via the affected interface. Exploitation enables observation or access to logs, browser data, or network traffic where the password is inadvertently stored or transmitted. Successful compromise yields high confidentiality and integrity impacts, allowing attackers to capture valid credentials for unauthorized access to Tugtainer instances.

The GitHub security advisory (GHSA-f2qf-f544-xm4p) and patching commit (9d23bf40ac1d39005582abfcf0a84753a4e29d52) confirm that upgrading to version 1.16.1 resolves the issue by modifying the authentication to avoid query parameter usage. Security practitioners should prioritize updating affected Tugtainer deployments and review existing logs for exposed credentials.