Portainer
Containers · products/portainer.yaml · RSS
Latest 2.45.2 Oct 8, 2026
Recent releases
securityFixed a bypass of the "Hide bind mounts for non-administrators" setting. When it is enabled, Compose files deployed by non-administrators can no longer reference host files outside the stack directory (for example in configs, secrets or env_file), and include is disabled for them.
securityFixed a denied, failed or dry-run Kubernetes namespace deletion still removing Portainer's namespace access policies, stack records and registry bindings. These records are now removed only after Kubernetes accepts the deletion
securityFixed in-cluster HTTPS connections to the Kubernetes API server skipping TLS certificate verification during stack deploy and removal, on both the server and the agent
securityHardened outbound requests against SSRF. Helm chart resolution and Git HTTP/HTTPS operations now go through the SSRF-aware transport, and the static rules that enforce this now match by type rather than by import alias, so an aliased import can no longer slip past them
breakingRemoved unused non-FIPS code paths from FIPS builds
securityUpdated golang.org/x/mod to 0.40.0, fixing CVE-2026-56865 and CVE-2026-56864
securityFixed a critical Docker proxy authorization bypass. Unrecognised API version prefixes like /v1.47.0/ or /v01.47/ skipped access control entirely, letting non-admin users reach the Docker API directly
securityClosed a remaining gap in the CVE-2026-44849 (GHSA-5fxq-qcf3-244w) fix and broadened bind-mount restrictions for non-admin users, now including Compose and Swarm stack deployments
securitySingle-namespace Kubernetes endpoints now check the caller’s namespace authorization instead of running as admin
securityFixed unauthorized access via leftover service accounts
securityFixed path traversal in the swarm compose deployer, where configs/secrets file paths escaped the project root
securityCVE remediation:
securityFixes CVE-2026-55761: Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. In versions 2.39.0 t…
securityAdded a one-time setup token, printed to the server logs at startup, that is required to create the first administrator account or restore a backup on a new, uninitialised instance.
securityImplemented an SSRF protection mechanism with a configurable allow-list in settings (off / audit / enforce modes)
securityRemoval of legacy CSRF fallback (scheduled). The legacy-csrf feature flag, introduced in 2.41 as a temporary migration aid, has been removed as scheduled. Users still relying on this flag must resolve any CSRF configuration issues before upgrading (see the 2.41 breaking changes for details). This…
securityFixed Docker exec endpoint to enforce container resource controls, preventing unauthorized exec access to containers.
securityFixed Docker proxy to enforce resource controls on /containers/{id}/attach/ws WebSocket endpoint.
securityFixes CVE-2026-44883: Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to befor…
breakingPortainer fails to start with a fatal log entry like failed to build server | error="invalid url for trusted origin... trusted_origin: \"portainer.example.com\"". The new implementation requires each entry in the trusted origins list to be a full URL including scheme (e.g.…
breakingBrowser requests return 403 Forbidden on state-changing actions, with CSRF check failed entries in the server logs. This means the browser's origin is not in the trusted origins list and needs to be added.
securityUpgraded CIRCL library to v1.6.3 to fix GO-2026-4550 incorrect secp384r1 CombinedMult calculation
securityUpgraded go-git to v5.17.0 to fix GO-2026-4473 improper verification of data integrity for .idx and .pack files
securityUpgraded OpenTelemetry Go SDK to v1.41.0 to fix GO-2026-4394 arbitrary code execution via PATH hijacking vulnerability
securityCVE-2026-39821
securityCVE-2026-56862
securityCVE-2026-56859
securityClosed a remaining gap in the CVE-2026-44849 (GHSA-5fxq-qcf3-244w) fix and broadened bind-mount restrictions for non-admin users, now including Compose and Swarm stack deployments
securityImplemented an SSRF protection mechanism with a configurable allow-list in settings (off / audit / enforce modes)
securityChanged a default setting to enforce server-side EdgeID on first connection
securityFixed path traversal in the swarm compose deployer, where configs/secrets file paths escaped the project root
securityUpgraded the Alpine base image from 3.23.4 to 3.24.1 to address OS-level package CVEs, including the jq advisories (CVE-2026-32316, CVE-2026-40164 and others)
securityCVE-2026-53488
securityCVE-2026-53492
securityFixes CVE-2026-55761: Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. In versions 2.39.0 t…
securityCVE-2026-45570
securityCVE-2026-45571
securityBumped in-toto-golang to 0.11.0 to address GHSA-pmwq-pjrm-6p5r
securityFixed a full-read server-side request forgery (SSRF) vulnerability in the GitLab Registry Proxy endpoint that could be exploited via the X-Gitlab-Domain header
securityCVE-2026-34165
Security advisories
5.9 CVE-2026-55761 Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. In versions 2.39.0 t…
8.5 CVE-2026-44850 Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to befor…
9.9 CVE-2026-44881 Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to befor…
8.1 CVE-2026-44882 Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to befor…
7.5 CVE-2026-44883 Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to befor…
6.5 CVE-2026-44884 Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to befor…
5.5 CVE-2026-44885 Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to befor…
8.8 CVE-2026-44848 Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to befor…
8.8 CVE-2026-44849 Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to befor…
7.5 CVE-2024-33662 Portainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function.
5.3 CVE-2024-29296 A user enumeration vulnerability was found in Portainer CE 2.19.4. This issue occurs during user authentication process, where a difference in response time could allow a remote unauthenticated use…
9.8 CVE-2022-24961 In Portainer Agent before 2.11.1, an API server can continue running even if not associated with a Portainer instance in the past few days.
6.1 CVE-2021-42650 Cross Site Scripting (XSS vulnerability exists in Portainer before 2.9.1 via the node input box in Custom Templates.
8.8 CVE-2020-24263 Portainer 1.24.1 and earlier is affected by an insecure permissions vulnerability that may lead to remote arbitrary code execution. A non-admin user is allowed to spawn new containers with critical…
9.8 CVE-2020-24264 Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to remote arbitrary code execution. The restriction checks for bind mounts are applied only on the client-side and…