OIDC Authentication Bypass in Tugtainer by Quenary

CVE-2026-55181

What is CVE-2026-55181?

Tugtainer, a self-hosted application designed for automating Docker container updates, has a flaw in its OIDC authentication mechanism. While the feature can be disabled via settings, attackers can still initiate the OIDC login flow by making a direct request to the login endpoint. This issue allows unauthorized access to the OIDC authorization process, potentially leading to security risks. The vulnerability, which has been addressed in version 1.30.3, highlights the importance of proper access controls and secure configurations in self-hosted applications.

References