CVE-2026-44882 Details
Description
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33., Portainer proxies requests to Kubernetes clusters through a middleware layer (kubeClientMiddleware) that validates the requesting user's token before forwarding traffic to the cluster. When security.RetrieveTokenData returned an error, the middleware wrote an HTTP 403 response but was missing a return statement — execution continued into the handler with a nil tokenData value. The Kubernetes endpoints sit behind Portainer's outer AuthenticatedAccess bouncer, so an attacker requires a valid Portainer session. However, a user whose secondary token validation fails in kubeClientMiddleware — for example a user without permission to access a given Kubernetes endpoint — would have their request forwarded to the cluster anyway, bypassing the authorization check. The same defect was present in both the CE and EE codebases. This vulnerability is fixed in 2.33.8.
An authorization bypass vulnerability has been identified in Portainer Community Edition versions 2.33.0 prior to 2.33.8. The issue arises in the Kubernetes middleware layer, kubeClientMiddleware, which validates user tokens before forwarding requests to Kubernetes clusters. When token validation failed, the middleware incorrectly continued processing requests without a valid token, allowing users to access Kubernetes endpoints they should not have permission for. This vulnerability could be exploited by any user with a valid Portainer session, bypassing authorization checks and potentially leading to unauthorized access or modification of Kubernetes resources.
Users can upgrade to Portainer Community Edition 2.33.8 or 2.39.0 and later versions, where this vulnerability has been fixed. For those unable to upgrade immediately, it is recommended to restrict Kubernetes endpoint access for users who do not need it and to audit the Kubernetes RBAC permissions of the service account used by Portainer to ensure least-privilege access.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/portainer/portainer/security/advisories/GHSA-mgq6-4x29-88r3 | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| portainer portainer | >= 2.33.0, < 2.33.8 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | Initial Analysis | [email protected] |
| May 28, 2026 | New CVE Received | [email protected] |