Unauthenticated Access Vulnerability in Tugtainer by Quenary

CVE-2026-55494

What is CVE-2026-55494?

Tugtainer, a self-hosted application designed for automating Docker container updates, contains a vulnerability that allows unauthenticated access to its Docker management APIs when the AGENT_SECRET configuration is not set. This security flaw arises because the signature verification in the application can erroneously validate requests when AGENT_SECRET is empty, leading to unauthorized access to protected API routes. The issue was mitigated in version 1.30.4, which enforces proper authentication to safeguard against such access.

References