CVE-2026-55181

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDC_ENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. However, a direct request to /auth/oidc/login still starts the OIDC login flow, returns HTTP 302, sets an oidc_state cookie, and redirects the user to the configured OIDC authorization endpoint. This bypasses the intended OIDC disable switch. This issue has been patched in version 1.30.3.

• CWE-284

• https://github.com/Quenary/tugtainer/commit/76371db679334b002d4af544b0f3b8587ad86f52
• https://github.com/Quenary/tugtainer/releases/tag/v1.30.3
• https://github.com/Quenary/tugtainer/security/advisories/GHSA-rg7c-vpfp-2w43
• https://github.com/Quenary/tugtainer/security/advisories/GHSA-rg7c-vpfp-2w43

Published

Sep 30, 2026

Last Modified

Sep 30, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55175Spinnaker is an open source, multi-cloud continuous delivery…7.5
• CVE-2026-55176Soft Machine is a Virtual Machine–based agentic development …9
• CVE-2026-55177CloudTAK is a browser-based Common Operating Picture and sit…7.6
• CVE-2026-55178GeoLens is a self-hosted geospatial data catalog with semant…7.5
• CVE-2026-55179Joplin is an open source note-taking and to-do application t…6.5
• CVE-2026-55180pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm…6.5
• CVE-2026-55182LibreNMS is a network monitoring system. In versions from 21…8.6
• CVE-2026-55183RClone Manager is a cross-platform GUI application designed …9.6
• CVE-2026-55184EspoCRM is an open source customer relationship management a…3.5
• CVE-2026-55185Miniflux 2 is an open source feed reader. Prior to 2.3.1, Is…5.1
• CVE-2026-55187Mailpit is an email testing tool and API for developers. Pri…5.8
• CVE-2026-55188RustFS is a distributed object storage system built in Rust.…8.2