Tugtainer, a self‑hosted Docker container automation tool, contains an authentication flaw in versions older than 1.16.1. The password supplied for authentication is appended to the request URL as a query string rather than being placed in the request body. Because the URL is logged by the server, it may appear in access logs, browser history, Referer headers, and proxy logs, resulting in the disclosure of user credentials. This weakness aligns with CWE‑598 – Exposing Sensitive Information Through an Improper Transfer Mechanism.

The vulnerability affects all installations of Quenary Tugtainer versions earlier than 1.16.1. Administrators should review any deployment that has not been updated to 1.16.1 or later, regardless of the operating environment, as the flaw is present in all such releases.

The CVSS score of 8.1 indicates high severity, yet the EPSS score of less than 1 % suggests a low probability of exploitation. The vulnerability is not included in the CISA KEV catalog. Exploitation would most likely be passive, with an attacker gleaning credentials from server logs, search histories, or forwarded Referer headers. No direct remote code execution or privilege escalation is possible, but the exposure of authentication secrets can lead to account compromise, unauthorized access to container registries, and potential lateral movement within an environment.