Read the docs
TI-2026-32759 Aliases CVE-2026-44884GHSA-cqpq-2fgr-8mvc

Portainer: Missing authorization on custom template file endpoint exposes template content

Priority LOW 26CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8 and 2.39.1, a missing authorization vulnerability in the Custom Template file endpoint (GET /api/custom_templates/{id}/file) allows any authenticated user to read the file content of any custom template by enumerating sequential integer IDs, bypassing Resource Control access restrictions. Template files may contain environment-specific values such as connection strings, API tokens, or registry credentials that administrators would not expect standard users to read. This vulnerability is fixed in 2.33.8 and 2.39.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00257 17th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed portainer (portainer): 2.33.8, 2.39.1github.com/portainer/portainer (Go): 2.33.8, 2.39.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
portainerportainer2.33.0 to before 2.33.8; 2.39.0 to before 2.39.12.33.8, 2.39.1Patch availableCNA
—github.com/portainer/portainer (Go)2.33.0 to before 2.33.82.33.8Patch availableGHSA-cqpq-2fgr-8mvc
—github.com/portainer/portainer (Go)2.39.0 to before 2.39.12.39.1Patch availableGHSA-cqpq-2fgr-8mvc
  • portainer Vendorportainer Affected 2.33.0 to before 2.33.8; 2.39.0 to before 2.39.1 Fixed in 2.33.8, 2.39.1 Patch available CNA
  • github.com/portainer/portainer (Go) Vendor— Affected 2.33.0 to before 2.33.8 Fixed in 2.33.8 Patch available GHSA-cqpq-2fgr-8mvc
  • github.com/portainer/portainer (Go) Vendor— Affected 2.39.0 to before 2.39.1 Fixed in 2.39.1 Patch available GHSA-cqpq-2fgr-8mvc

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:portainer:portainer:*:*:*:*:community:*:*:*2.33.0 to before 2.33.8; 2.39.0 to before 2.39.1Vulnerableportainer
  • cpe:2.3:a:portainer:portainer:*:*:*:*:community:*:*:* Versions 2.33.0 to before 2.33.8; 2.39.0 to before 2.39.1 Vulnerable ·portainer

Remediation

  • Fix · CNA portainer (portainer) Fixed in 2.33.8, 2.39.1
  • Fix · GHSA-cqpq-2fgr-8mvc github.com/portainer/portainer (Go) Fixed in 2.33.8 Advisory →
  • Fix · GHSA-cqpq-2fgr-8mvc github.com/portainer/portainer (Go) Fixed in 2.39.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44884
  2. 2026-10-03 Alias added: GHSA-cqpq-2fgr-8mvc

References

Exploit 1

Advisory 1

Other 3

  • TI-2026-32726 Portainer: Missing authorization on Docker plugin endpoints allows host RCE CVSS 4.0CRITICAL 9.4
  • TI-2026-32758 Portainer: JWT accepted in URL query leaks tokens to logs and referers CVSS 4.0HIGH 7.7
  • TI-2026-32727 Portainer: Endpoint security bypass via Swarm service create/update CVSS 4.0CRITICAL 9.4
  • TI-2020-14859 Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to… CVSS 3.1CRITICAL 9.8
  • TI-2024-22245 Portainer before 2.20.0 allows redirects when the target is not index.yaml. CVSS 3.1CRITICAL 9.1
  • TI-2018-13786 A vulnerability was found in Portainer before 1.20.0. CVSS 3.0CRITICAL 9.8
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences