CVE-2026-72533 Portainer CVE debrief

Who should care

Administrators and users of Portainer CE, especially those with low-privileged user accounts, should be aware of this vulnerability and take necessary actions to mitigate the risk.

Technical summary

The CVE-2026-72533 vulnerability is an authentication bypass issue in Portainer CE through 2.44.0. It allows authenticated low-privileged users to bypass Docker proxy authorization checks by exploiting non-canonical URL normalization. The vulnerability arises because the proxy endpoint does not normalize request paths before applying access controls, enabling crafted requests to be interpreted differently by the proxy and authorization layer. Successful exploitation could grant an attacker root-level access to the underlying Docker host.

Defensive priority

Authenticated low-privileged users could bypass Docker proxy authorization checks, potentially gaining root-level access to the underlying Docker host.

Recommended defensive actions

• Review and update Portainer CE to a version that addresses the authentication bypass vulnerability
• Implement additional monitoring and logging to detect potential exploitation attempts
• Restrict access to the Docker host and limit the privileges of low-privileged users
• Verify and enforce proper authorization and authentication mechanisms for Docker proxy requests
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE description indicates an authentication bypass vulnerability in Portainer CE through 2.44.0. The vulnerability allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization. The proxy endpoint fails to normalize request paths before applying access controls, allowing crafted requests to be interpreted differently by the proxy and the authorization layer.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.