Read the docs
TI-2026-32726 Aliases CVE-2026-44848GHSA-rrmm-9v76-h3p4

Portainer: Missing authorization on Docker plugin endpoints allows host RCE

Priority HIGH 76CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, The Docker plugin management endpoints (/plugins/*) were not registered with a handler, so standard users with endpoint access could call privileged plugin operations — including installing and enabling plugins — directly against the underlying Docker daemon. The vulnerability is exposed when a non-admin Portainer user (Standard User role, or any role granted endpoint-level access) has been given access to a Docker endpoint via Portainer RBAC. This vulnerability is fixed in 2.33.8, 2.39.2, and 2.41.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00402 34th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed portainer (portainer): 2.33.8, 2.39.2, 2.41.0github.com/portainer/portainer (Go): 2.33.8, 2.39.2, 2.41.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
portainerportainer2.33.0 to before 2.33.8; 2.39.0 to before 2.39.2; 2.40.0 to before 2.41.02.33.8, 2.39.2, 2.41.0Patch availableCNA
—github.com/portainer/portainer (Go)2.33.0 to before 2.33.82.33.8Patch availableGHSA-rrmm-9v76-h3p4
—github.com/portainer/portainer (Go)2.39.0 to before 2.39.22.39.2Patch availableGHSA-rrmm-9v76-h3p4
—github.com/portainer/portainer (Go)2.40.0 to before 2.41.02.41.0Patch availableGHSA-rrmm-9v76-h3p4
  • portainer Vendorportainer Affected 2.33.0 to before 2.33.8; 2.39.0 to before 2.39.2; 2.40.0 to before 2.41.0 Fixed in 2.33.8, 2.39.2, 2.41.0 Patch available CNA
  • github.com/portainer/portainer (Go) Vendor— Affected 2.33.0 to before 2.33.8 Fixed in 2.33.8 Patch available GHSA-rrmm-9v76-h3p4
  • github.com/portainer/portainer (Go) Vendor— Affected 2.39.0 to before 2.39.2 Fixed in 2.39.2 Patch available GHSA-rrmm-9v76-h3p4
  • github.com/portainer/portainer (Go) Vendor— Affected 2.40.0 to before 2.41.0 Fixed in 2.41.0 Patch available GHSA-rrmm-9v76-h3p4

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:portainer:portainer:*:*:*:*:community:*:*:*2.33.0 to before 2.33.8; 2.34.0 to before 2.39.2Vulnerableportainer
cpe:2.3:a:portainer:portainer:2.40.0:*:*:*:community:*:*:*2.40.0Vulnerableportainer
  • cpe:2.3:a:portainer:portainer:*:*:*:*:community:*:*:* Versions 2.33.0 to before 2.33.8; 2.34.0 to before 2.39.2 Vulnerable ·portainer
  • cpe:2.3:a:portainer:portainer:2.40.0:*:*:*:community:*:*:* Versions 2.40.0 Vulnerable ·portainer

Remediation

  • Fix · CNA portainer (portainer) Fixed in 2.33.8, 2.39.2, 2.41.0
  • Fix · GHSA-rrmm-9v76-h3p4 github.com/portainer/portainer (Go) Fixed in 2.33.8 Advisory →
  • Fix · GHSA-rrmm-9v76-h3p4 github.com/portainer/portainer (Go) Fixed in 2.39.2 Advisory →
  • Fix · GHSA-rrmm-9v76-h3p4 github.com/portainer/portainer (Go) Fixed in 2.41.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44848
  2. 2026-10-03 Alias added: GHSA-rrmm-9v76-h3p4

References

Exploit 1

Advisory 1

Other 4

  • TI-2026-32758 Portainer: JWT accepted in URL query leaks tokens to logs and referers CVSS 4.0HIGH 7.7
  • TI-2026-32727 Portainer: Endpoint security bypass via Swarm service create/update CVSS 4.0CRITICAL 9.4
  • TI-2020-14859 Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to… CVSS 3.1CRITICAL 9.8
  • TI-2024-22245 Portainer before 2.20.0 allows redirects when the target is not index.yaml. CVSS 3.1CRITICAL 9.1
  • TI-2018-13786 A vulnerability was found in Portainer before 1.20.0. CVSS 3.0CRITICAL 9.8
  • TI-2018-09100 Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with… CVSS 3.0CRITICAL 9.8
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences