CVE-2026-44848criticalCWE-862

CVE-2026-44848: critical vulnerability in portainer

Portainer: Missing authorization on Docker plugin endpoints allows host RCE

Published · Updated

Follow this CVE+ Monitor portainer+ Monitor github.com/portainer/portainer

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.4epss 0.4%
from disclosure to weapon82 days
Published on NVDMay 28
1st PoC+82d
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, The Docker plugin management endpoints (/plugins/*) were not registered with a handler, so standard users with endpoint access could call privileged plugin operations — including installing and enabling plugins — directly against the underlying Docker daemon. The vulnerability is exposed when a non-admin Portainer user (Standard User role, or any role granted endpoint-level access) has been given access to a Docker endpoint via Portainer RBAC. This vulnerability is fixed in 2.33.8, 2.39.2, and 2.41.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
portainer · portainer
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — portainer

In the same product, most dangerous first.

CVE-2026-44885MEDIUMPortainer: Path traversal in backup archive extraction allows arbitrary file writeEPSS 0.6%CVE-2026-44881HIGHPortainer: Arbitrary File Read via Git Symlink Injection in Stack Auto-UpdateEPSS 0.5%CVE-2026-55761HIGHPortainer: Unauthenticated Restore Endpoint Allows Admin Takeover on Uninitialised Portainer InstancesEPSS 0.5%CVE-2026-44849CRITICALPortainer: Endpoint security bypass via Swarm service create/updateEPSS 0.4%CVE-2025-49593MEDIUMPortainer HTTP Headers May Leak to Malicious Container RegistriesEPSS 0.4%CVE-2026-44882HIGHPortainer: Kubernetes middleware continues after token validation failure, bypassing endpoint authorizationEPSS 0.3%