Description
Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code execution. An authenticated non-administrative user with endpoint access can exploit these settings to read host files or obtain root equivalent access on the host.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Portainer Portainer Community Edition
Default version status: unaffected
0 to < 2.39.0affected0 to < 2.38.0affected
References
- https://intwave.com/blog/2026/02/26/improving-portainer-security.html ↗
- https://github.com/portainer/portainer/commit/ac8fa7672e732b44b970c9eaf928eddd2c68796c ↗
- https://github.com/portainer/portainer/commit/3e2fdb1891e81a8e4c5c8beb60e45f07c8ecae52 ↗
- http://www.openwall.com/lists/oss-security/2026/06/12/2 ↗