CVE-2025-49593 Details

A vulnerability exists in Portainer Community Edition prior to version 2.31.0, and in Portainer Enterprise Edition prior to version 2.31.0, allowing for the unintentional leakage of HTTP headers, including registry authentication credentials and Portainer session tokens, to a registered malicious container registry. This could occur if a Portainer administrator is persuaded to register the malicious registry or if an existing registry is compromised.

Users are advised to update to Portainer Community Edition or Business Edition version 2.31.0 or later. For those using Portainer LTS, version 2.27.7 or later should be installed.