Read the docs
TI-2026-32728 Aliases CVE-2026-44850GHSA-7fw3-x4r2-g7wc

Portainer: Bind-mount restriction bypass via HostConfig.Mounts

Priority LOW 36CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer offers an environment-level Disable bind mounts for non-administrators security setting that blocks regular users from binding host paths into containers they create through the Portainer-mediated Docker API. The check that enforces this setting only inspected the legacy HostConfig.Binds array on the container-create proxy and never looked at the equivalent HostConfig.Mounts array. Any authenticated user with rights to create containers on a Docker environment where the restriction is enabled could submit a bind-typed entry under HostConfig.Mounts and mount any host path into their container. This vulnerability is fixed in 2.33.8, 2.39.2, and 2.41.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00234 14th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed portainer (portainer): 2.33.8, 2.39.2, 2.41.0github.com/portainer/portainer (Go): 2.33.8, 2.39.2, 2.41.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
portainerportainer2.33.0 to before 2.33.8; 2.39.0 to before 2.39.2; 2.40.0 to before 2.41.02.33.8, 2.39.2, 2.41.0Patch availableCNA
—github.com/portainer/portainer (Go)2.33.0 to before 2.33.82.33.8Patch availableGHSA-7fw3-x4r2-g7wc
—github.com/portainer/portainer (Go)2.39.0 to before 2.39.22.39.2Patch availableGHSA-7fw3-x4r2-g7wc
—github.com/portainer/portainer (Go)2.40.0 to before 2.41.02.41.0Patch availableGHSA-7fw3-x4r2-g7wc
  • portainer Vendorportainer Affected 2.33.0 to before 2.33.8; 2.39.0 to before 2.39.2; 2.40.0 to before 2.41.0 Fixed in 2.33.8, 2.39.2, 2.41.0 Patch available CNA
  • github.com/portainer/portainer (Go) Vendor— Affected 2.33.0 to before 2.33.8 Fixed in 2.33.8 Patch available GHSA-7fw3-x4r2-g7wc
  • github.com/portainer/portainer (Go) Vendor— Affected 2.39.0 to before 2.39.2 Fixed in 2.39.2 Patch available GHSA-7fw3-x4r2-g7wc
  • github.com/portainer/portainer (Go) Vendor— Affected 2.40.0 to before 2.41.0 Fixed in 2.41.0 Patch available GHSA-7fw3-x4r2-g7wc

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:portainer:portainer:*:*:*:*:community:*:*:*2.33.0 to before 2.33.8; 2.34.0 to before 2.39.1Vulnerableportainer
cpe:2.3:a:portainer:portainer:2.40.0:*:*:*:community:*:*:*2.40.0Vulnerableportainer
  • cpe:2.3:a:portainer:portainer:*:*:*:*:community:*:*:* Versions 2.33.0 to before 2.33.8; 2.34.0 to before 2.39.1 Vulnerable ·portainer
  • cpe:2.3:a:portainer:portainer:2.40.0:*:*:*:community:*:*:* Versions 2.40.0 Vulnerable ·portainer

Remediation

  • Fix · CNA portainer (portainer) Fixed in 2.33.8, 2.39.2, 2.41.0
  • Fix · GHSA-7fw3-x4r2-g7wc github.com/portainer/portainer (Go) Fixed in 2.33.8 Advisory →
  • Fix · GHSA-7fw3-x4r2-g7wc github.com/portainer/portainer (Go) Fixed in 2.39.2 Advisory →
  • Fix · GHSA-7fw3-x4r2-g7wc github.com/portainer/portainer (Go) Fixed in 2.41.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44850
  2. 2026-10-03 Alias added: GHSA-7fw3-x4r2-g7wc

References

Exploit 1

Advisory 1

Other 4

  • TI-2026-32726 Portainer: Missing authorization on Docker plugin endpoints allows host RCE CVSS 4.0CRITICAL 9.4
  • TI-2026-32758 Portainer: JWT accepted in URL query leaks tokens to logs and referers CVSS 4.0HIGH 7.7
  • TI-2026-32727 Portainer: Endpoint security bypass via Swarm service create/update CVSS 4.0CRITICAL 9.4
  • TI-2020-14859 Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to… CVSS 3.1CRITICAL 9.8
  • TI-2024-22245 Portainer before 2.20.0 allows redirects when the target is not index.yaml. CVSS 3.1CRITICAL 9.1
  • TI-2018-13786 A vulnerability was found in Portainer before 1.20.0. CVSS 3.0CRITICAL 9.8
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences