Quenary vulnerabilities
We track 7 vulnerabilities in Quenary products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on September 30, 2026.
Latest Quenary vulnerabilities
- 8.1 High severity
tugtainer: Improper Verification of Cryptographic Signature
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, when the OIDC login flow completes, backend/modules/auth/providers/auth_oidc_provider.py decodes the id_token returned by the identity provider's token endpoin
- 9.1 Critical severity
tugtainer: Server-Side Request Forgery
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test end
- 9.8 Critical severity
tugtainer: Improper Access Control
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENT_SECRET is not configured. The Agent uses request signatures to protect its A
- 9.4 Critical severity
tugtainer: Improper Access Control
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDC_ENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. H
- 9.9 Critical severity
tugtainer: Improper Neutralization of Special Elements Used in a Template Engine
Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection (SSTI) in the notification template feature. The `title_template` and `body_template` fields are rendered usin
- 9.1 Critical severity
tugtainer: Use of HTTP Request With Sensitive Query String
Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in
- 9.8 Critical severity
tugtainer: Improper Neutralization of Special Elements used in a Command
Tugtainer is a self-hosted app for automating updates of docker containers. In versions prior to 1.15.1, arbitary arguments can be injected in tugtainer-agent `POST api/command/run`. Version 1.15.1 fixes the issue.