PHP2Shell : See if you’re affected with a free external attack surface scan. Click Here > 

Back
New CVE Detected

CVE-2026-55181 – Authentication Bypass (OIDC Login Enforcement Failure) – Tugtainer ≤ 1.30.2

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-55181 is a critical improper access control vulnerability (CWE-284) in Tugtainer, a self-hosted application for automating Docker container updates. When an administrator disables OpenID Connect (OIDC) authentication, the application continues to accept and process OIDC login requests, allowing the authentication flow to be initiated despite being administratively turned off. The flaw carries a CVSS v3.1 base score of 9.4 (Critical) and affects all Tugtainer versions up to and including 1.30.2.

Technical details

  • Root cause: in backend/modules/auth/providers/auth_oidc_provider.py, the login() method calls the async is_enabled() method without the await keyword. Because this returns a coroutine object (which is always truthy) rather than the actual boolean enabled state, the check that is supposed to block OIDC when disabled never evaluates correctly.
  • The /auth/oidc/enabled status endpoint correctly reports OIDC as disabled, creating a false sense that the login path is also blocked.
  • A direct, unauthenticated request to /auth/oidc/login still starts the OIDC login flow: it returns an HTTP 302 redirect, sets an oidc_state session cookie, and redirects the requester to the configured OIDC identity provider’s authorization endpoint.
  • The associated callback handler lacks sufficient verification before processing authorization responses and issuing session credentials.
  • Attack vector: network, no privileges or user interaction required (AV:N/AC:L/PR:N/UI:N).
  • Impact: high confidentiality and integrity impact, with low availability impact — an attacker can abuse the still-active OIDC flow to attempt authentication bypass or session/credential abuse even though OIDC was explicitly disabled by the administrator.

Affected software

  • Quenary Tugtainer versions ≤ 1.30.3 (all releases up to and including 1.30.2; patched in 1.30.3)

Severity

  • CVSS v3.1 Base Score: 9.4 (Critical)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Mitigation and recommended actions

  • Immediate: upgrade Tugtainer to v1.30.3 or later, which correctly awaits the OIDC enablement check before allowing the login flow to proceed.
  • If immediate patching is not possible: restrict network access to the Tugtainer management interface (e.g., place it behind a VPN, reverse proxy with authentication, or IP allow-list) so that /auth/oidc/login and related endpoints cannot be reached by untrusted clients, and monitor for unexpected requests to OIDC authentication paths.
  • After patching, review any OIDC provider logs for unexpected authorization requests originating from the Tugtainer instance during the exposure window.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge