CVE-2026-44849

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer enforces seven EndpointSecuritySettings restrictions that administrators configure to restrict the container configurations non-admin users can launch: privileged mode, host PID namespace, device mapping, capabilities, sysctls, security-opt (Seccomp / AppArmor), and bind mounts. These restrictions are enforced on the standard container creation path, but several of them are not applied on the Docker Swarm service API. This vulnerability is fixed in 2.33.8, 2.39.2, and 2.41.0.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/portainer/portainer/security/advisories/GHSA-5fxq-qcf3-244w	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:portainer:portainer:::::community:::*
	cpe:2.3:a:portainer:portainer:::::community:::*
	cpe:2.3:a:portainer:portainer:2.40.0::::community:::

History

01 Jun 2026, 17:59

Type	Values Removed	Values Added
References	~~() https://github.com/portainer/portainer/security/advisories/GHSA-5fxq-qcf3-244w -~~	() https://github.com/portainer/portainer/security/advisories/GHSA-5fxq-qcf3-244w - Exploit, Third Party Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 8.8
First Time		Portainer Portainer portainer
CPE		cpe:2.3:a:portainer:portainer:2.40.0::::community::: cpe:2.3:a:portainer:portainer:::::community:::*

28 May 2026, 22:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-28 22:16

Updated : 2026-06-01 17:59

NVD link : CVE-2026-44849

Mitre link : CVE-2026-44849

CVE.ORG link : CVE-2026-44849

JSON object : View

Products Affected

portainer

portainer

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-44849", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-05-28T22:16:58.973", "references": [{"url": "https://github.com/portainer/portainer/security/advisories/GHSA-5fxq-qcf3-244w", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer enforces seven EndpointSecuritySettings restrictions that administrators configure to restrict the container configurations non-admin users can launch: privileged mode, host PID namespace, device mapping, capabilities, sysctls, security-opt (Seccomp / AppArmor), and bind mounts. These restrictions are enforced on the standard container creation path, but several of them are not applied on the Docker Swarm service API. This vulnerability is fixed in 2.33.8, 2.39.2, and 2.41.0."}], "lastModified": "2026-06-01T17:59:18.843", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:portainer:portainer:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "4E7FE81D-D489-4034-9DB4-D48E3B6C3CE4", "versionEndExcluding": "2.33.8", "versionStartIncluding": "2.33.0"}, {"criteria": "cpe:2.3:a:portainer:portainer:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "3717D3CE-5226-41F7-A131-7CCAF164914D", "versionEndExcluding": "2.39.1", "versionStartIncluding": "2.34.0"}, {"criteria": "cpe:2.3:a:portainer:portainer:2.40.0:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "69F71AFC-F50D-4D10-9918-413D8E841CC2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}