Vulnerabilities

TI-2026-50793 CVE-2026-72533 · GHSA-588v-59vc-3xh9

Portainer Portainer CE - Authentication Bypass

MEDIUM 41

An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00556 Published 2026-08-11 No fix listed CWE-287

TI-2026-40250 CVE-2026-55761 · GHSA-x626-fcwx-f5pc

Portainer: Unauthenticated Restore Endpoint Allows Admin Takeover on Uninitialised Portainer Instances

LOW 32

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments.

CVSS 4.0HIGH 7.1 Network No auth No interaction EPSS 0.00493 Published 2026-07-08 Fixed in 2.39.4, 2.43.0 CWE-287

TI-2026-32756 CVE-2026-44881 · GHSA-rpgq-m5fp-32wr

Portainer: Arbitrary File Read via Git Symlink Injection in Stack Auto-Update

LOW 37

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments.

CVSS 4.0HIGH 8.5 Network Low privileges No interaction EPSS 0.0051 Published 2026-05-28 Fixed in 2.33.8, 2.39.2 +1 CWE-200

TI-2026-32726 CVE-2026-44848 · GHSA-rrmm-9v76-h3p4

Portainer: Missing authorization on Docker plugin endpoints allows host RCE

HIGH 76

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00402 Published 2026-05-28 Fixed in 2.33.8, 2.39.2 +1 CWE-862

TI-2026-32727 CVE-2026-44849 · GHSA-5fxq-qcf3-244w

Portainer: Endpoint security bypass via Swarm service create/update

MEDIUM 49

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00425 Published 2026-05-28 Fixed in 2.33.8, 2.39.2 +1 CWE-862

TI-2026-32728 CVE-2026-44850 · GHSA-7fw3-x4r2-g7wc

Portainer: Bind-mount restriction bypass via HostConfig.Mounts

LOW 36

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00234 Published 2026-05-28 Fixed in 2.33.8, 2.39.2 +1 CWE-863

TI-2026-32757 CVE-2026-44882 · GHSA-mgq6-4x29-88r3

Portainer: Kubernetes middleware continues after token validation failure, bypassing endpoint authorization

LOW 37

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00335 Published 2026-05-28 Fixed in 2.33.8 CWE-863

TI-2026-32758 CVE-2026-44883 · GHSA-jvp4-q659-95mj

Portainer: JWT accepted in URL query leaks tokens to logs and referers

HIGH 69

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00291 Published 2026-05-28 Fixed in 2.33.8, 2.39.2 +1 CWE-598

TI-2026-32759 CVE-2026-44884 · GHSA-cqpq-2fgr-8mvc

Portainer: Missing authorization on custom template file endpoint exposes template content

LOW 26

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00257 Published 2026-05-28 Fixed in 2.33.8, 2.39.1 CWE-862

TI-2026-32760 CVE-2026-44885 · GHSA-m8fg-67j7-cx4v

Portainer: Path traversal in backup archive extraction allows arbitrary file write

LOW 26

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00606 Published 2026-05-28 Fixed in 2.33.8 CWE-22

TI-2026-25972 CVE-2026-33590 · GHSA-frhv-529m-5v9v

Insecure default permissions in Portainer CE

LOW 39

Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code execution.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00452 Published 2026-05-28 Fixed in 2.39.0, 2.38.0 CWE-276

TI-2025-31606 CVE-2025-49593

Portainer HTTP Headers May Leak to Malicious Container Registries

LOW 32

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments.

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.004 Published 2025-06-17 Fixed in 2.27.7, 2.31.0 CWE-200

TI-2024-22246 CVE-2024-33662 · GHSA-9mjw-79r6-c9m8

Portainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function.

LOW 35

Portainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00282 Published 2024-10-02 Fixed in 2.20.2 CWE-326

TI-2024-22245 CVE-2024-33661 · GHSA-6cm9-r25c-5778

Portainer before 2.20.0 allows redirects when the target is not index.yaml.

MEDIUM 48

Portainer before 2.20.0 allows redirects when the target is not index.yaml.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00623 Published 2024-04-25 No fix listed CWE-601

TI-2024-19421 CVE-2024-29296 · GHSA-87x6-8m9v-g8c2

A user enumeration vulnerability was found in Portainer CE 2.19.4.

LOW 33

A user enumeration vulnerability was found in Portainer CE 2.19.4.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01252 Published 2024-04-10 Fixed in 0.6.1-0.20240417040827-48bc7d0d92f0 CWE-286

TI-2022-08760 CVE-2022-24961 · GHSA-mx58-xr7v-245r

In Portainer Agent before 2.11.1, an API server can continue running even if not…

MEDIUM 45

In Portainer Agent before 2.11.1, an API server can continue running even if not associated with a Portainer instance in the past few days.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01644 Published 2022-02-11 No fix listed

TI-2021-18884 CVE-2021-42650 · GHSA-v3j8-q37p-7695

Cross Site Scripting (XSS vulnerability exists in Portainer before 2.9.1 via the node input box in Custom Templates.

LOW 28

Cross Site Scripting (XSS vulnerability exists in Portainer before 2.9.1 via the node input box in Custom Templates.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00626 Published 2021-10-18 No fix listed CWE-79

TI-2020-14859 CVE-2020-24264 · GHSA-3mrp-3hmp-9cg3

Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to…

MEDIUM 49

Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to remote arbitrary code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04116 Published 2021-03-16 No fix listed CWE-863

TI-2020-14858 CVE-2020-24263 · GHSA-4vq9-fqw4-6r9r

Portainer 1.24.1 and earlier is affected by an insecure permissions vulnerability that…

MEDIUM 41

Portainer 1.24.1 and earlier is affected by an insecure permissions vulnerability that may lead to remote arbitrary code execution.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01601 Published 2021-03-16 No fix listed CWE-732

TI-2019-12585 CVE-2019-16877 · GHSA-j5px-9g9w-fvp5

Portainer before 1.22.1 has Incorrect Access Control (issue 4 of 4).

MEDIUM 40

Portainer before 1.22.1 has Incorrect Access Control (issue 4 of 4).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01036 Published 2019-11-07 No fix listed

TI-2019-12586 CVE-2019-16878 · GHSA-mww8-4q2m-9jw9

Portainer before 1.22.1 has XSS (issue 2 of 2).

LOW 25

Portainer before 1.22.1 has XSS (issue 2 of 2).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00516 Published 2019-11-07 No fix listed CWE-79

TI-2019-12584 CVE-2019-16876 · GHSA-8v7q-5cpp-2jfp

Portainer before 1.22.1 allows Directory Traversal.

LOW 36

Portainer before 1.22.1 allows Directory Traversal.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01352 Published 2019-11-07 No fix listed CWE-22

TI-2019-12581 CVE-2019-16872 · GHSA-4cqf-vpcq-9pvx

Portainer before 1.22.1 has Incorrect Access Control (issue 1 of 4).

MEDIUM 45

Portainer before 1.22.1 has Incorrect Access Control (issue 1 of 4).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01355 Published 2019-11-07 No fix listed

TI-2019-12583 CVE-2019-16874 · GHSA-5vjx-25rg-wwch

Portainer before 1.22.1 has Incorrect Access Control (issue 2 of 4).

LOW 31

Portainer before 1.22.1 has Incorrect Access Control (issue 2 of 4).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0089 Published 2019-11-07 No fix listed

TI-2019-12582 CVE-2019-16873 · GHSA-9rhf-h2ph-4597

Portainer before 1.22.1 has XSS (issue 1 of 2).

LOW 25

Portainer before 1.22.1 has XSS (issue 1 of 2).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00521 Published 2019-11-07 No fix listed CWE-79

Vulnerabilities

Filters