Tugtainer Agent: Missing authentication for Docker management API

Summary

Tugtainer Agent, a component of the self-hosted Docker update tool Tugtainer, accepts requests to its Docker management APIs without authentication when AGENT_SECRET is not configured. The signature check returns successfully on an empty secret, so protected agent routes are reachable by anyone who can reach the agent port. Because the agent controls Docker, an attacker can likely gain full control over the host. A public proof-of-concept exists and the CVSS score is 9.8.

Affected

• Tugtainer versions before 1.30.4
• Tugtainer Agent instances where AGENT_SECRET is not set

Fixed in

• Version 1.30.4 (AGENT_SECRET is now mandatory)

Workaround

• Set a strong, unique AGENT_SECRET on the agent and the hub, and set it in the UI under Hosts > Edit > Agent Secret
• Do not expose the agent port to the internet or untrusted networks
• Use AGENT_ALLOW_NETWORKS and AGENT_ALLOW_ENDPOINTS on the hub as an additional restriction (not a replacement for the patch)

Exploitation

• Public proof-of-concept: yes (a public GitHub repository; not verified)
• Known exploited in the wild: no evidence found, not listed in CISA KEV
• CISA SSVC: exploitation poc, automatable yes, technical impact total

Our recommendation

• Upgrade all Tugtainer and Tugtainer Agent instances to 1.30.4 or later; update agent containers manually with compose
• Verify that AGENT_SECRET is set on every agent and that agent ports are not reachable from the internet or untrusted networks
• Review Docker host logs for unexpected API calls and unknown containers
• Inventory all instances, including app-store or appliance installs

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  4qu4r1um/tugtainer-1.30.2-CVE-2026-55494-and-CVE-2026-62308-to-RCE

Research sources

• Fix commit 0052a55 github.com
• Release v1.30.4 github.com
• GitHub Security Advisory GHSA-wgw2-c96g-p7h7 github.com
• OSV entry CVE-2026-55494 osv.dev
• Tugtainer project README github.com
• TheHackerWire vulnerability page www.thehackerwire.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:47.