CVE-2026-44849 Details
Description
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer enforces seven EndpointSecuritySettings restrictions that administrators configure to restrict the container configurations non-admin users can launch: privileged mode, host PID namespace, device mapping, capabilities, sysctls, security-opt (Seccomp / AppArmor), and bind mounts. These restrictions are enforced on the standard container creation path, but several of them are not applied on the Docker Swarm service API. This vulnerability is fixed in 2.33.8, 2.39.2, and 2.41.0.
A vulnerability exists in Portainer Community Edition versions 2.33.0 prior to 2.33.8, 2.39.0 prior to 2.39.2, and 2.40.0 prior to 2.41.0. It allows non-admin users with access to Docker Swarm endpoints to bypass endpoint security settings enforced by administrators. These settings are designed to restrict container configurations that non-admin users can deploy. The vulnerability arises because several security checks are not applied when creating or updating services via the Docker Swarm API, leaving room for users to exploit these oversights and potentially access sensitive resources or escalate privileges.
Users should upgrade to Portainer versions 2.33.8, 2.39.2, or 2.41.0. For those unable to upgrade immediately, it is recommended to revoke Swarm endpoint access for non-admin users, segregate manager and worker nodes, and block the creation of local-driver volumes that use certain bind-style options on untrusted endpoints.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/portainer/portainer/security/advisories/GHSA-5fxq-qcf3-244w | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| portainer portainer | >= 2.33.0, < 2.33.8 >= 2.34.0, < 2.39.1 2.40.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | Initial Analysis | [email protected] |
| May 28, 2026 | New CVE Received | [email protected] |