CVE-2026-47752
Tugtainer, a self‑hosted tool that automates Docker container updates, has a critical flaw in its notification template feature. Versions before 1.30.2 render user‑supplied templates with an unsandboxed Jinja2 environment, letting any authenticated user run arbitrary OS commands as root inside the container. The issue is fixed in Tugtainer 1.30.2.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Tugtainer versions earlier than 1.30.2, used by organizations that host the app to manage Docker containers.
Real-world impact
An attacker who can log into the Tugtainer instance can execute any shell command with root privileges inside the container, potentially taking full control of the host system.
Why this severity
The CVSS score of 9.9 reflects that the vulnerability is network‑exposed, requires only low attack complexity and low privileges, needs no user interaction, changes the scope of the system, and gives an attacker full confidentiality, integrity, and availability compromise.
What to do about it
- 01Upgrade Tugtainer to version 1.30.2 or later.
- 02Restart the Tugtainer service to apply the update.
NVD-referenced vendor advisory
Timeline
- Jul 23, 2026 · 9d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 9d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.