CVE-2026-55494Critical· 9.8▾ AbyssalPoC availableTugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENT_SECRET is not configured. The Agent uses request sign…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 53.9 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.8%
1 GitHub repo (last check)
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENT_SECRET is not configured. The Agent uses request signatures to protect its API routes. However, in agent/auth.py, the signature verification function returns successfully if Config.AGENT_SECRET is empty. This causes protected Agent APIs to become accessible without authentication. This issue has been patched in version 1.30.4.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55181Critical· 9.4Tugtainer is a self-hosted app for automating updates of Docker containers
CVE-2026-87004High· 8.1Tugtainer is a self-hosted app for automating updates of Docker containers
CVE-2026-62308Critical· 9.1Tugtainer is a self-hosted app for automating updates of Docker containers
CVE-2025-69201Critical· 9.8Tugtainer is a self-hosted app for automating updates of docker containers
CVE-2025-10070Medium· 6.3Portabilis i-Educar enturmacao-em-lote access control
CVE-2025-10071Medium· 6.3Portabilis i-Educar cancelar-enturmacao-em-lote access control