Portainer vulnerabilities

Products

• Portainer 27

Newest

• portainer ce Portainer Portainer CE - Authentication Bypass CVE-2026-72533 8.8 HighAugust 11, 2026
• portainer Portainer: Unauthenticated Restore Endpoint Allows Admin Takeover on Uninitialised Portainer Instances CVE-2026-55761 Fix available 7.1 HighJuly 8, 2026
• portainer community edition Insecure default permissions in Portainer CE CVE-2026-33590 8.5 HighMay 28, 2026
• portainer Portainer: Missing authorization on custom template file endpoint exposes template content CVE-2026-44884 Fix available 6.0 MediumMay 14, 2026
• portainer Portainer: JWT accepted in URL query leaks tokens to logs and referers CVE-2026-44883 Fix available 7.7 HighMay 14, 2026
• portainer Portainer: Endpoint security bypass via Swarm service create/update CVE-2026-44849 Fix available 9.4 CriticalMay 14, 2026
• portainer Portainer: Kubernetes middleware continues after token validation failure, bypassing endpoint authorization CVE-2026-44882 Fix available 8.1 HighMay 14, 2026
• portainer Portainer: Arbitrary File Read via Git Symlink Injection in Stack Auto-Update CVE-2026-44881 Public exploitFix available 8.5 HighMay 14, 2026
• portainer Portainer: Bind-mount restriction bypass via HostConfig.Mounts CVE-2026-44850 Fix available 8.5 HighMay 14, 2026
• portainer Portainer: Path traversal in backup archive extraction allows arbitrary file write CVE-2026-44885 Fix available 5.5 MediumMay 14, 2026
• portainer Portainer: Missing authorization on Docker plugin endpoints allows host RCE CVE-2026-44848 Public exploitFix available 9.4 CriticalMay 14, 2026
• portainer Portainer HTTP Headers May Leak to Malicious Container Registries CVE-2025-49593 6.8 MediumJune 17, 2025
• portainer Portainer improperly uses an encryption algorithm in the AesEncrypt function CVE-2024-33662 Fix available 7.5 HighOctober 2, 2024
• portainer Portainer before 2.20.0 allows redirects when the target is not index.yaml. CVE-2024-33661 9.1 CriticalApril 25, 2024
• portainer Portainer CE allows username enumeration through authentication response timing CVE-2024-29296 Public exploitFix available 5.3 MediumApril 10, 2024
• portainer In Portainer Agent before 2.11.1, an API server can continue running even if not associated with... CVE-2022-24961 9.8 CriticalFebruary 11, 2022
• portainer Cross Site Scripting (XSS vulnerability exists in Portainer before 2.9.1 via the node input box... CVE-2021-42650 6.1 MediumOctober 18, 2021
• portainer Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to remote... CVE-2020-24264 9.8 CriticalMarch 16, 2021
• portainer Portainer 1.24.1 and earlier is affected by an insecure permissions vulnerability that may lead... CVE-2020-24263 8.8 HighMarch 16, 2021
• portainer Portainer before 1.22.1 has Incorrect Access Control (issue 4 of 4). CVE-2019-16877 8.8 HighNovember 7, 2019
• portainer Portainer before 1.22.1 has XSS (issue 2 of 2). CVE-2019-16878 5.4 MediumNovember 7, 2019
• portainer Portainer before 1.22.1 allows Directory Traversal. CVE-2019-16876 7.5 HighNovember 7, 2019
• portainer Portainer before 1.22.1 has Incorrect Access Control (issue 1 of 4). CVE-2019-16872 9.9 CriticalNovember 7, 2019
• portainer Portainer before 1.22.1 has Incorrect Access Control (issue 2 of 4). CVE-2019-16874 6.5 MediumNovember 7, 2019
• portainer Portainer before 1.22.1 has XSS (issue 1 of 2). CVE-2019-16873 5.4 MediumNovember 7, 2019
• portainer A vulnerability was found in Portainer before 1.20.0. Portainer stores LDAP credentials,... CVE-2018-19466 Public exploit 9.8 CriticalMarch 27, 2019
• portainer Portainer through 1.19.2 provides an API endpoint (/api/users/admin/check) to verify that the... CVE-2018-19367 9.8 CriticalNovember 20, 2018
• portainer A stored Cross-site scripting (XSS) vulnerability in Portainer through 1.19.1 allows remote... CVE-2018-16316 5.4 MediumSeptember 1, 2018
• portainer Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with an... CVE-2018-12678 9.8 CriticalJune 22, 2018