Read the docs
TI-2025-31606 Aliases CVE-2025-49593

Portainer HTTP Headers May Leak to Malicious Container Registries

Priority LOW 32CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. Prior to STS version 2.31.0 and LTS version 2.27.7, if a Portainer administrator can be convinced to register a malicious container registry, or an existing container registry can be taken over, HTTP Headers (including registry authentication credentials or Portainer session tokens) may be leaked to that registry. This issue has been patched in STS version 2.31.0 and LTS version 2.27.7.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.004 34th percentileScored 2026-11-07
Fix Fixed portainer (portainer): 2.27.7, 2.31.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
portainerportainerbefore 2.27.7; before 2.31.02.27.7, 2.31.0Patch availableCNA
  • portainer Vendorportainer Affected before 2.27.7; before 2.31.0 Fixed in 2.27.7, 2.31.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:portainer:portainer:*:*:*:*:*:*:*:*——portainer
  • cpe:2.3:a:portainer:portainer:*:*:*:*:*:*:*:* Versions — — ·portainer

Remediation

  • Fix · CNA portainer (portainer) Fixed in 2.27.7, 2.31.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-49593

References

Other 3

  • TI-2026-32726 Portainer: Missing authorization on Docker plugin endpoints allows host RCE CVSS 4.0CRITICAL 9.4
  • TI-2026-32758 Portainer: JWT accepted in URL query leaks tokens to logs and referers CVSS 4.0HIGH 7.7
  • TI-2026-32727 Portainer: Endpoint security bypass via Swarm service create/update CVSS 4.0CRITICAL 9.4
  • TI-2020-14859 Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to… CVSS 3.1CRITICAL 9.8
  • TI-2024-22245 Portainer before 2.20.0 allows redirects when the target is not index.yaml. CVSS 3.1CRITICAL 9.1
  • TI-2018-13786 A vulnerability was found in Portainer before 1.20.0. CVSS 3.0CRITICAL 9.8
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences