PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44849 portainer CVE debrief

Portainer Community Edition versions 2.33.0 through 2.33.7, 2.39.x prior to 2.39.2, and 2.41.0 contain a critical authorization bypass vulnerability. The platform's EndpointSecuritySettings feature allows administrators to restrict container configurations for non-admin users across seven categories: privileged mode, host PID namespace, device mapping, capabilities, sysctls, security-opt (Seccomp/AppArmor), and bind mounts. While these restrictions are properly enforced on standard container creation paths, they are not applied to the Docker Swarm service API, allowing non-admin users to bypass security controls when deploying services via Swarm. This represents a missing authorization check (CWE-862) that could enable container escape and host compromise. The vulnerability was disclosed on May 28, 2026, with fixes released in versions 2.33.8, 2.39.2, and 2.41.0.

Vendor
portainer
Product
Unknown
CVSS
CRITICAL 9.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations using Portainer Community Edition to manage Docker Swarm environments with multi-user access, particularly those relying on EndpointSecuritySettings to enforce container security boundaries for non-administrative users.

Technical summary

The vulnerability exists in the Docker Swarm service API implementation within Portainer Community Edition. While the standard container creation API enforces EndpointSecuritySettings restrictions configured by administrators, the Swarm service API path lacks equivalent enforcement. This allows authenticated non-admin users to deploy services with restricted configurations including privileged containers, host PID namespace access, dangerous capabilities, and unrestricted bind mounts. The CVSS 4.0 score of 9.4 reflects the high impact potential: network-accessible attack surface, low complexity exploitation, and comprehensive compromise of confidentiality, integrity, and availability.

Defensive priority

critical

Recommended defensive actions

  • Upgrade Portainer Community Edition to version 2.33.8, 2.39.2, or 2.41.0 or later
  • Audit Docker Swarm services deployed by non-admin users for unauthorized privileged configurations
  • Review EndpointSecuritySettings policies to ensure restrictions align with organizational security requirements
  • Implement network segmentation to limit access to Portainer management interfaces
  • Monitor for anomalous Swarm service deployments that may indicate exploitation attempts

Evidence notes

Vulnerability confirmed via GitHub Security Advisory GHSA-5fxq-qcf3-244w. CVSS 4.0 vector indicates network attack vector with low attack complexity, low privileges required, and high impact across confidentiality, integrity, and availability for both the vulnerable component and subsequent systems.

Official resources

2026-05-28