portainer Community Edition up to 2.33.7/2.39.1/2.40.x Portainer-mediated Docker API authorization

Summaryinfo

A vulnerability was found in portainer Community Edition up to 2.33.7/2.39.1/2.40.x. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Portainer-mediated Docker API. Executing a manipulation can lead to authorization. The identification of this vulnerability is CVE-2026-44850. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in portainer Community Edition up to 2.33.7/2.39.1/2.40.x and classified as critical. This vulnerability affects some unknown processing of the component Portainer-mediated Docker API. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer offers an environment-level Disable bind mounts for non-administrators security setting that blocks regular users from binding host paths into containers they create through the Portainer-mediated Docker API. The check that enforces this setting only inspected the legacy HostConfig.Binds array on the container-create proxy and never looked at the equivalent HostConfig.Mounts array. Any authenticated user with rights to create containers on a Docker environment where the restriction is enabled could submit a bind-typed entry under HostConfig.Mounts and mount any host path into their container. This vulnerability is fixed in 2.33.8, 2.39.2, and 2.41.0.

The advisory is available at github.com. This vulnerability was named CVE-2026-44850 since 05/07/2026. The exploitation appears to be easy. The attack can be initiated remotely. The technical details are unknown and an exploit is not available.

Upgrading to version 2.33.8, 2.39.2 or 2.41.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• portainer

Name

• Community Edition

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29
• 2.30
• 2.31
• 2.32
• 2.33
• 2.33.0
• 2.33.1
• 2.33.2
• 2.33.3
• 2.33.4
• 2.33.5
• 2.33.6
• 2.33.7
• 2.34
• 2.35
• 2.36
• 2.37
• 2.38
• 2.39
• 2.39.0
• 2.39.1
• 2.40

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion