Read the docs
TI-2026-32727 Aliases CVE-2026-44849GHSA-5fxq-qcf3-244w

Portainer: Endpoint security bypass via Swarm service create/update

Priority MEDIUM 49CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer enforces seven EndpointSecuritySettings restrictions that administrators configure to restrict the container configurations non-admin users can launch: privileged mode, host PID namespace, device mapping, capabilities, sysctls, security-opt (Seccomp / AppArmor), and bind mounts. These restrictions are enforced on the standard container creation path, but several of them are not applied on the Docker Swarm service API. This vulnerability is fixed in 2.33.8, 2.39.2, and 2.41.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00425 37th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed portainer (portainer): 2.33.8, 2.39.2, 2.41.0github.com/portainer/portainer (Go): 2.33.8, 2.39.2, 2.41.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
portainerportainer2.33.0 to before 2.33.8; 2.39.0 to before 2.39.2; 2.40.0 to before 2.41.02.33.8, 2.39.2, 2.41.0Patch availableCNA
—github.com/portainer/portainer (Go)2.33.0 to before 2.33.82.33.8Patch availableGHSA-5fxq-qcf3-244w
—github.com/portainer/portainer (Go)2.39.0 to before 2.39.22.39.2Patch availableGHSA-5fxq-qcf3-244w
—github.com/portainer/portainer (Go)2.40.0 to before 2.41.02.41.0Patch availableGHSA-5fxq-qcf3-244w
  • portainer Vendorportainer Affected 2.33.0 to before 2.33.8; 2.39.0 to before 2.39.2; 2.40.0 to before 2.41.0 Fixed in 2.33.8, 2.39.2, 2.41.0 Patch available CNA
  • github.com/portainer/portainer (Go) Vendor— Affected 2.33.0 to before 2.33.8 Fixed in 2.33.8 Patch available GHSA-5fxq-qcf3-244w
  • github.com/portainer/portainer (Go) Vendor— Affected 2.39.0 to before 2.39.2 Fixed in 2.39.2 Patch available GHSA-5fxq-qcf3-244w
  • github.com/portainer/portainer (Go) Vendor— Affected 2.40.0 to before 2.41.0 Fixed in 2.41.0 Patch available GHSA-5fxq-qcf3-244w

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:portainer:portainer:*:*:*:*:community:*:*:*2.33.0 to before 2.33.8; 2.34.0 to before 2.39.1Vulnerableportainer
cpe:2.3:a:portainer:portainer:2.40.0:*:*:*:community:*:*:*2.40.0Vulnerableportainer
  • cpe:2.3:a:portainer:portainer:*:*:*:*:community:*:*:* Versions 2.33.0 to before 2.33.8; 2.34.0 to before 2.39.1 Vulnerable ·portainer
  • cpe:2.3:a:portainer:portainer:2.40.0:*:*:*:community:*:*:* Versions 2.40.0 Vulnerable ·portainer

Remediation

  • Fix · CNA portainer (portainer) Fixed in 2.33.8, 2.39.2, 2.41.0
  • Fix · GHSA-5fxq-qcf3-244w github.com/portainer/portainer (Go) Fixed in 2.33.8 Advisory →
  • Fix · GHSA-5fxq-qcf3-244w github.com/portainer/portainer (Go) Fixed in 2.39.2 Advisory →
  • Fix · GHSA-5fxq-qcf3-244w github.com/portainer/portainer (Go) Fixed in 2.41.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44849
  2. 2026-10-03 Alias added: GHSA-5fxq-qcf3-244w

References

Exploit 1

Advisory 1

Other 4

  • TI-2026-32726 Portainer: Missing authorization on Docker plugin endpoints allows host RCE CVSS 4.0CRITICAL 9.4
  • TI-2026-32758 Portainer: JWT accepted in URL query leaks tokens to logs and referers CVSS 4.0HIGH 7.7
  • TI-2020-14859 Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to… CVSS 3.1CRITICAL 9.8
  • TI-2024-22245 Portainer before 2.20.0 allows redirects when the target is not index.yaml. CVSS 3.1CRITICAL 9.1
  • TI-2018-13786 A vulnerability was found in Portainer before 1.20.0. CVSS 3.0CRITICAL 9.8
  • TI-2018-09100 Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with… CVSS 3.0CRITICAL 9.8
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences