PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44849 portainer CVE debrief

Portainer Community Edition versions 2.33.0 through 2.33.7, 2.39.x prior to 2.39.2, and 2.41.0 contain a critical authorization bypass vulnerability. The platform's EndpointSecuritySettings feature allows administrators to restrict container configurations for non-admin users across seven categories: privileged mode, host PID namespace, device mapping, capabilities, sysctls, security-opt (Seccomp/AppArmor), and bind mounts. While these restrictions are properly enforced on standard container creation paths, they are not applied to the Docker Swarm service API, allowing non-admin users to bypass security controls when deploying services via Swarm. This represents a missing authorization check (CWE-862) that could enable container escape and host compromise. The vulnerability was disclosed on May 28, 2026, with fixes released in versions 2.33.8, 2.39.2, and 2.41.0.

Vendor
portainer
Product
Unknown
CVSS
CRITICAL 9.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-07-21
Advisory published
2026-05-28
Advisory updated
2026-07-21

Who should care

Organizations using Portainer Community Edition to manage Docker Swarm environments with multi-user access, particularly those relying on EndpointSecuritySettings to enforce container security boundaries for non-administrative users.

Technical summary

The vulnerability exists in the Docker Swarm service API implementation within Portainer Community Edition. While the standard container creation API enforces EndpointSecuritySettings restrictions configured by administrators, the Swarm service API path lacks equivalent enforcement. This allows authenticated non-admin users to deploy services with restricted configurations including privileged containers, host PID namespace access, dangerous capabilities, and unrestricted bind mounts. The CVSS 4.0 score of 9.4 reflects the high impact potential: network-accessible attack surface, low complexity exploitation, and comprehensive compromise of confidentiality, integrity, and availability.

Defensive priority

critical

Recommended defensive actions

  • Upgrade Portainer Community Edition to version 2.33.8, 2.39.2, or 2.41.0 or later
  • Audit Docker Swarm services deployed by non-admin users for unauthorized privileged configurations
  • Review EndpointSecuritySettings policies to ensure restrictions align with organizational security requirements
  • Implement network segmentation to limit access to Portainer management interfaces
  • Monitor for anomalous Swarm service deployments that may indicate exploitation attempts

Evidence notes

Vulnerability confirmed via GitHub Security Advisory GHSA-5fxq-qcf3-244w. CVSS 4.0 vector indicates network attack vector with low attack complexity, low privileges required, and high impact across confidentiality, integrity, and availability for both the vulnerable component and subsequent systems.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-44849 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-44849

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-44849 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44849

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.