CRITICAL

CVE-2026-62308

CVSS v3

9.1

CRITICAL

EPSS Score

0.4 %

exploit probability, as of 2026-10-01

CISA KEV

known exploited

Exploitation

—

SSVC status

Description

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/test_notification endpoint accepts a urls field and passes it directly to Apprise without restricting protocols, hostnames, localhost addresses, private IP ranges, or cloud metadata addresses. This can be abused as an a

Technical details

CVSS v3 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Published: 2026-09-30
Last Modified: 2026-09-30

Frequently asked questions

What is CVE-2026-62308?

Is CVE-2026-62308 actively exploited?

Active exploitation of CVE-2026-62308 has not been confirmed. Its EPSS score was 0.4% on 2026-10-01, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2026-62308?

CVE-2026-62308 has a CVSS v3 base score of 9.1 (CRITICAL severity), with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L.

Is CVE-2026-62308 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.

Check an IP Search CVEs SIEM & TIP integrations

No credit card required · 500 free checks/month · Free API key

Other 2026 vulnerabilities worth triaging

Ranked by exploit probability (EPSS).

Back to CVE Database