CVE-2026-44883 Details
Description
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer's authentication middleware accepts JWT bearer tokens passed as the ?token=<JWT> URL query parameter on any authenticated API endpoint, in addition to the standard Authorization: Bearer header. URLs are recorded in reverse-proxy access logs, browser history, and HTTP Referer headers on outbound navigation, so any JWT passed this way can be harvested by anyone with access to those logs or by an external site the user subsequently visits. A leaked token grants the full privileges of the user it was issued to, until the token expires (default 8 hours, configurable). The ?token= parameter was used by Portainer's browser-based container attach, exec, and pod shell features, so any user with exec or attach rights on a container was exposed — not only administrators. This vulnerability is fixed in 2.33.8, 2.39.2, and 2.41.0.
A vulnerability exists in Portainer Community Edition versions 2.33.0 prior to 2.33.8, 2.39.0 prior to 2.39.2, and 2.40.0 prior to 2.41.0. The issue arises because the authentication middleware accepts JWT bearer tokens via the '?token=<JWT>' URL query parameter on authenticated API endpoints. This acceptance of query-parameter tokens leads to leakage, as URLs are logged in reverse-proxy access logs, browser history, and HTTP Referer headers. A leaked token, which grants full user privileges until expiration (default 8 hours), can be exploited by anyone with access to the logs or by an external site visited afterward. The vulnerability affects users with exec or attach rights on containers, not just administrators.
Users can upgrade to Portainer versions 2.33.8, 2.39.2, or 2.41.0. For those unable to upgrade immediately, it is recommended to strip the '?token=' parameter at the reverse proxy, audit existing logs for token occurrences, and avoid sharing Portainer URLs containing tokens.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/portainer/portainer/security/advisories/GHSA-jvp4-q659-95mj | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/portainer/portainer/security/advisories/GHSA-jvp4-q659-95mj | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-598 | Use of GET Request Method With Sensitive Query Strings | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| portainer portainer | >= 2.33.0, < 2.33.8 >= 2.34.0, < 2.39.2 >= 2.40.0, < 2.41.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | Initial Analysis | [email protected] |
| May 28, 2026 | New CVE Received | [email protected] |