CVE-2026-55494: CWE-284: Improper Access Control in Quenary tugtainer
CVE-2026-55494 is a critical improper access control vulnerability in Quenary's Tugtainer, a self-hosted app for automating Docker container updates. Versions prior to 1.30.4 allow unauthenticated access to Docker management APIs if the AGENT_SECRET configuration is not set. This occurs because the signature verification function in the agent's authentication module returns success when AGENT_SECRET is empty, effectively disabling authentication. The issue has been fixed in version 1.30.4.
AI Analysis
Technical Summary
Tugtainer Agent's API protection relies on request signatures validated using a secret (AGENT_SECRET). In versions before 1.30.4, if AGENT_SECRET is not configured (left empty), the signature verification function incorrectly returns success, bypassing authentication. This allows unauthenticated users to access Docker management APIs through the Agent, leading to potential full compromise of confidentiality, integrity, and availability of the Docker environment. The vulnerability is tracked as CVE-2026-55494 and is classified under CWE-284 (Improper Access Control). It has a CVSS v3.1 score of 9.8, indicating critical severity. The issue is patched in Tugtainer version 1.30.4.
Potential Impact
Exploitation of this vulnerability allows unauthenticated attackers to access and control Docker management APIs via the Tugtainer Agent, potentially leading to full compromise of containerized environments. This includes unauthorized container management, data exposure, and disruption of services. The CVSS score of 9.8 reflects high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Upgrade Tugtainer to version 1.30.4 or later, where this vulnerability is patched. Ensure that AGENT_SECRET is properly configured to enable signature verification and protect API routes. No additional mitigations are necessary once the patch is applied.
CVE-2026-55494: CWE-284: Improper Access Control in Quenary tugtainer
Description
CVE-2026-55494 is a critical improper access control vulnerability in Quenary's Tugtainer, a self-hosted app for automating Docker container updates. Versions prior to 1.30.4 allow unauthenticated access to Docker management APIs if the AGENT_SECRET configuration is not set. This occurs because the signature verification function in the agent's authentication module returns success when AGENT_SECRET is empty, effectively disabling authentication. The issue has been fixed in version 1.30.4.
CVSS v3.1
Score 9.8critical
Affected software
Quenary
tugtainer
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Tugtainer Agent's API protection relies on request signatures validated using a secret (AGENT_SECRET). In versions before 1.30.4, if AGENT_SECRET is not configured (left empty), the signature verification function incorrectly returns success, bypassing authentication. This allows unauthenticated users to access Docker management APIs through the Agent, leading to potential full compromise of confidentiality, integrity, and availability of the Docker environment. The vulnerability is tracked as CVE-2026-55494 and is classified under CWE-284 (Improper Access Control). It has a CVSS v3.1 score of 9.8, indicating critical severity. The issue is patched in Tugtainer version 1.30.4.
Potential Impact
Exploitation of this vulnerability allows unauthenticated attackers to access and control Docker management APIs via the Tugtainer Agent, potentially leading to full compromise of containerized environments. This includes unauthorized container management, data exposure, and disruption of services. The CVSS score of 9.8 reflects high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Upgrade Tugtainer to version 1.30.4 or later, where this vulnerability is patched. Ensure that AGENT_SECRET is properly configured to enable signature verification and protect API routes. No additional mitigations are necessary once the patch is applied.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-16T22:28:27.062Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6abd446a2a4e24523d49ff1a
Added to database: 09/30/2026, 17:18:34 UTC
Last enriched: 09/30/2026, 17:32:58 UTC
Last updated: 09/30/2026, 17:32:58 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.