Portainer 2.39.3 → 2.45.2
14 releases · 6 breaking changes · 145 security fixes · 1 advisory fixed
145security6breaking6deprecated87feature121fix
Vulnerabilities fixed by this upgrade
- 5.9 CVE-2026-55761 Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. In versions 2.39.0 t…
Breaking changes
- breaking Removed unused non-FIPS code paths from FIPS builds in 2.45.1
- breaking Provision KaaS Cluster feature in 2.43.0
- breaking Removed OpenAMT integration. in 2.42.0
- breaking Portainer fails to start with a fatal log entry like failed to build server | error="invalid url for trusted origin... trusted_origin: \"portainer.example.com\"". The new implementation requires each entry in the trusted origins list to be a full URL including scheme (e.g.… in 2.41.0
- breaking Browser requests return 403 Forbidden on state-changing actions, with CSRF check failed entries in the server logs. This means the browser's origin is not in the trusted origins list and needs to be added. in 2.41.0
- breaking Removed MicroK8s cluster provisioning and management integration from the EE server. in 2.41.0
Security changes
- security Fixed a bypass of the "Hide bind mounts for non-administrators" setting. When it is enabled, Compose files deployed by non-administrators can no longer reference host files outside the stack directory (for example in configs, secrets or env_file), and include is disabled for them. in 2.45.2
- security Fixed a denied, failed or dry-run Kubernetes namespace deletion still removing Portainer's namespace access policies, stack records and registry bindings. These records are now removed only after Kubernetes accepts the deletion in 2.45.2
- security Fixed in-cluster HTTPS connections to the Kubernetes API server skipping TLS certificate verification during stack deploy and removal, on both the server and the agent in 2.45.2
- security Hardened outbound requests against SSRF. Helm chart resolution and Git HTTP/HTTPS operations now go through the SSRF-aware transport, and the static rules that enforce this now match by type rather than by import alias, so an aliased import can no longer slip past them in 2.45.1
- security Updated golang.org/x/mod to 0.40.0, fixing CVE-2026-56865 and CVE-2026-56864 in 2.45.1
- security Updated golang.org/x/crypto to 0.56.0, fixing CVE-2026-56854 (High), CVE-2026-78662 and CVE-2026-56855 in 2.45.1
- security Updated google.golang.org/grpc to 1.83.2, fixing CVE-2026-84304 in 2.45.1
- security Updated kubectl in the kubectl shell image to v1.37.0, which removes golang.org/x/net 0.49.0 entirely — fixing CVE-2026-39821 (Critical) along with 2 High and 5 Medium findings in 2.45.1
- security Updated helm in the kubectl shell image to v4.2.4, taking golang.org/x/net to 0.56.0 and fixing CVE-2026-46600 (High) in 2.45.1
- security Upgraded the Alpine packages in the kubectl shell image, taking openssl/libssl3 to 3.5.8-r0, libcurl to 8.22.0-r0 and jq to 1.8.2-r0. Clears 2 Critical findings (CVE-2026-63073 and CVE-2026-75803) plus 9 High, 11 Medium and 1 Low in 2.45.1
- security Fixed a critical Docker proxy authorization bypass. Unrecognised API version prefixes like /v1.47.0/ or /v01.47/ skipped access control entirely, letting non-admin users reach the Docker API directly in 2.45.0
- security Closed a remaining gap in the CVE-2026-44849 (GHSA-5fxq-qcf3-244w) fix and broadened bind-mount restrictions for non-admin users, now including Compose and Swarm stack deployments in 2.45.0
- security Single-namespace Kubernetes endpoints now check the caller’s namespace authorization instead of running as admin in 2.45.0
- security Read-only and Helpdesk users can no longer view Kubernetes secret data in 2.45.0
- security Standard users can no longer manage registry access in 2.45.0
- security Kubernetes authorization denials now return HTTP 403 instead of 500 in 2.45.0
- security Fixed a Kubernetes shell authorization flaw. Caller-supplied query parameters could override the server's pod target, letting a standard user run commands in any pod on Agent-managed Kubernetes environments in 2.45.0
- security Updated the Go toolchain to 1.26.6, fixing CVE-2026-39821 (Critical, 9.6), an IDNA validation bypass of hostname-based access controls, along with CVE-2026-42505, CVE-2026-39822, CVE-2026-56862, CVE-2026-56860, CVE-2026-56859, CVE-2026-56858, CVE-2026-56853, CVE-2026-46600 and CVE-2026-33818 in 2.45.0
- security Updated oras.land/oras-go/v2 to 2.6.2, fixing CVE-2026-50163 in 2.45.0
- security Updated github.com/go-git/go-git/v5 to 5.19.2, fixing CVE-2026-71556 and CVE-2026-71557 in 2.45.0
- security Updated go.opentelemetry.io/otel to 1.44.0, fixing CVE-2026-41178 in 2.45.0
- security Updated github.com/klauspost/compress to 1.18.7, fixing GHSA-259r-337f-4rfw in 2.45.0
- security Upgraded libcurl to 8.21.0-r0 in the kubectl-shell image to address the following CVEs: CVE-2026-11856, CVE-2026-10536, CVE-2026-11564, CVE-2026-12064, CVE-2026-11586, CVE-2026-11352, CVE-2026-9547, CVE-2026-9546, CVE-2026-9545, CVE-2026-9080, CVE-2026-9079, CVE-2026-8932, CVE-2026-8927,… in 2.45.0
- security Upgraded c-ares to 1.34.8-r0 in the kubectl-shell image to address CVE-2026-33630 in 2.45.0
- security Du Feilong () and Jerry () - added Docker --security-opt support and Swarm cluster self-heal after manager reap in 2.45.0
- security Fixed unauthorized access via leftover service accounts in 2.44.0
- security Fixed path traversal in the swarm compose deployer, where configs/secrets file paths escaped the project root in 2.44.0
- security CVE remediation: in 2.44.0
- security Upgraded oras.land/oras-go/v2 to 2.6.1 to remediate CVEs in 2.44.0
- security Upgraded containerd to 1.7.33 / v2 2.2.5 to remediate CVEs in 2.44.0
- security Upgraded google.golang.org/grpc to 1.82.1 to remediate GHSA-hrxh-6v49-42gf in 2.44.0
- security Upgraded axios to 1.18.0 to remediate CVEs in 2.44.0
- security Upgraded shell-quote to 1.8.4 to remediate CVEs in 2.44.0
- security Fixes CVE-2026-55761: Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. In versions 2.39.0 t… in 2.43.0
- security Added a one-time setup token, printed to the server logs at startup, that is required to create the first administrator account or restore a backup on a new, uninitialised instance. in 2.43.0
- security Implemented an SSRF protection mechanism with a configurable allow-list in settings (off / audit / enforce modes) in 2.43.0
- security Added an endpoint authorization check to /api/kubernetes/{id}/* routes, preventing users with no access from enumerating Kubernetes resources in 2.43.0
- security Fixed custom-template user-access checks that bypassed the Resource Control definition, allowing edit/inspect/delete authorization to ignore admins-only / public / team grants in 2.43.0
- security Filter GET namespace results by the user's allowed-namespace list, returning Forbidden for namespaces the user cannot access in 2.43.0
- security Bumped golang.org/x/net to v0.55.0 for the following CVEs: in 2.43.0
- security CVE-2026-39821, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-42502, CVE-2026-42506 in 2.43.0
- security Bumped golang.org/x/crypto to v0.52.0 for the following CVEs: in 2.43.0
- security CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-42508, CVE-2026-46595 in 2.43.0
- security Bumped go.opentelemetry.io/otel to v1.43.0 for the following CVEs: in 2.43.0
- security CVE-2026-39882, CVE-2026-39883 in 2.43.0
- security Bumped github.com/go-git/go-git/v5 to v5.19.1 for the following CVEs: in 2.43.0
- security CVE-2026-45571, GHSA-w5pp-99ch-qj29, CVE-2026-45570 in 2.43.0
- security Bumped Go stdlib to 1.26.4 for the following CVEs: in 2.43.0
- security CVE-2026-42504, CVE-2026-27145, CVE-2026-42507 in 2.43.0
- security Bumped Go to 1.26.3 for the following CVEs: in 2.43.0
- security CVE-2026-42499, CVE-2026-39836, CVE-2026-39820, CVE-2026-33814, CVE-2026-33811, CVE-2026-39826, CVE-2026-39823, CVE-2026-39825 in 2.43.0
- security Bumped containerd to 1.7.32 and containerd/v2 to 2.2.4 for the following CVEs: in 2.43.0
- security CVE-2026-46680 in 2.43.0
- security Upgraded the kubectl-shell Helm SDK to helm/v4 4.1.4 for the following CVEs: in 2.43.0
- security CVE-2026-35204, CVE-2026-35205 in 2.43.0
- security Removal of legacy CSRF fallback (scheduled). The legacy-csrf feature flag, introduced in 2.41 as a temporary migration aid, has been removed as scheduled. Users still relying on this flag must resolve any CSRF configuration issues before upgrading (see the 2.41 breaking changes for details). This… in 2.42.0
- security Fixed Docker exec endpoint to enforce container resource controls, preventing unauthorized exec access to containers. in 2.42.0
- security Fixed Docker proxy to enforce resource controls on /containers/{id}/attach/ws WebSocket endpoint. in 2.42.0
- security Fixed URL path rewriting to clear the RawPath field, preventing path traversal via percent-encoded paths. in 2.42.0
- security Changed a default setting to enforce server-side EdgeID on first connection. in 2.42.0
- security Authentication cookies now have the Secure attribute set automatically when Portainer is accessed over HTTPS. in 2.42.0
- security Upgraded golang.org/x/net to v0.54.0 to address CVE-2026-27141 and CVE-2026-33814. in 2.42.0
- security Upgraded github.com/go-git/go-git/v5 to v5.19.0 to address CVE-2026-34165, GHSA-3xc5-wrhm-f963, and CVE-2026-33762. in 2.42.0
- security Upgraded github.com/in-toto/in-toto-golang to v0.11.0 to address GHSA-pmwq-pjrm-6p5r. in 2.42.0
- security Upgraded github.com/Azure/go-ntlmssp to v0.1.1 to address CVE-2026-32952. in 2.42.0
- security Upgraded github.com/prometheus/prometheus to v0.311.3 to address CVE-2026-40179, GHSA-fw8g-cg8f-9j28, and CVE-2026-42151. in 2.42.0
- security Fixes CVE-2026-44883: Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to befor… in 2.41.0
- security Bumped Go toolchain to 1.26.2 to remediate the following CVEs: in 2.41.0
- security CVE-2026-32280 (crypto/x509 excessive chain-building work in Verify, denial of service) in 2.41.0
- security CVE-2026-32281 (crypto/x509 inefficient policy validation, denial of service) in 2.41.0
- security CVE-2026-32283 (crypto/tls 1.3 key update deadlock, uncontrolled resource consumption) in 2.41.0
- security CVE-2026-33810 (crypto/x509 excluded DNS constraints not applied to wildcard domains in different case) in 2.41.0
- security Bumped helm.sh/helm/v4 to v4.1.4 to remediate the following CVEs: in 2.41.0
- security CVE-2026-35204 (plugin version path traversal enables arbitrary file write; GHSA-vmx8-mqv2-9gmg) in 2.41.0
- security CVE-2026-35205 (plugin missing-provenance signature-verification bypass; GHSA-q5jf-9vfq-h4h7) in 2.41.0
- security Bumped github.com/moby/spdystream to v0.5.1 to remediate CVE-2026-35469. in 2.41.0
- security Upgraded the bundled Docker binary from v29.3.0 to v29.4.1 (agent, server-ce, server-ee, compose-unpacker), picking up Go 1.25.8 and 1.25.9 to mitigate the following CVEs: in 2.41.0
- security CVE-2026-25679 in 2.41.0
- security CVE-2026-27142 in 2.41.0
- security CVE-2026-27139 in 2.41.0
- security CVE-2026-32280 in 2.41.0
- security CVE-2026-32281 in 2.41.0
- security CVE-2026-32283 in 2.41.0
- security CVE-2026-32282 in 2.41.0
- security CVE-2026-32289 in 2.41.0
- security CVE-2026-32288 in 2.41.0
- security Upgraded CIRCL library to v1.6.3 to fix GO-2026-4550 incorrect secp384r1 CombinedMult calculation in 2.40.0
- security Upgraded go-git to v5.17.0 to fix GO-2026-4473 improper verification of data integrity for .idx and .pack files in 2.40.0
- security Upgraded OpenTelemetry Go SDK to v1.41.0 to fix GO-2026-4394 arbitrary code execution via PATH hijacking vulnerability in 2.40.0
- security Upgraded OpenTelemetry SDK to v1.42.0 to fix CVE-2026-24051 in 2.40.0
- security Upgraded Docker binary to v29.3.0 to mitigate CVE-2025-68121 in 2.40.0
- security Bumped golang-jwt/jwt/v4 to v4.5.2 to fix CVE-2025-30204 regression in 2.40.0
- security Upgraded gRPC to v1.79.3 to fix CVE-2026-33186 in 2.40.0
- security Fixed missing authorization check on the Custom Template file content API endpoint in 2.40.0
- security CVE-2026-39821 in 2.39.8
- security CVE-2026-56862 in 2.39.8
- security CVE-2026-56859 in 2.39.8
- security CVE-2026-56853 in 2.39.8
- security CVE-2026-33818 in 2.39.8
- security CVE-2026-56858 in 2.39.8
- security CVE-2026-56860 in 2.39.8
- security CVE-2026-56865 in 2.39.8
- security CVE-2026-56864 in 2.39.8
- security Upgraded kubectl in the kubectl shell image from 1.36.2 to 1.37.0, which is built with Go stdlib 1.26.6 and vendors golang.org/x/net 0.57.0, clearing 2 Critical findings (including CVE-2026-39821), 7 High and 7 Medium in 2.39.8
- security Closed a remaining gap in the CVE-2026-44849 (GHSA-5fxq-qcf3-244w) fix and broadened bind-mount restrictions for non-admin users, now including Compose and Swarm stack deployments in 2.39.7
- security Implemented an SSRF protection mechanism with a configurable allow-list in settings (off / audit / enforce modes) in 2.39.6
- security Changed a default setting to enforce server-side EdgeID on first connection in 2.39.6
- security Fixed path traversal in the swarm compose deployer, where configs/secrets file paths escaped the project root in 2.39.6
- security Upgraded the Go toolchain from 1.25.11 to 1.25.12 to address the following CVEs: in 2.39.6
- security CVE-2026-42505 in 2.39.6
- security CVE-2026-39822 in 2.39.6
- security Upgraded github.com/go-git/go-git/v5 to 5.19.2 to address the following CVEs: in 2.39.6
- security CVE-2026-71556 in 2.39.6
- security CVE-2026-71557 in 2.39.6
- security Upgraded oras.land/oras-go/v2 to 2.6.2 to address CVE-2026-50163 in 2.39.6
- security Upgraded go.opentelemetry.io/otel to 1.44.0 to address CVE-2026-41178 in 2.39.6
- security Upgraded github.com/klauspost/compress to 1.18.7 to address GHSA-259r-337f-4rfw in 2.39.6
- security Upgraded golang.org/x/net to 0.56.0 and golang.org/x/text to 0.39.0 in the Portainer updater to address the following CVEs: in 2.39.6
- security CVE-2026-46600 in 2.39.6
- security CVE-2026-56852 in 2.39.6
- security Upgraded github.com/containerd/containerd (v1) to 1.7.33 to address the following CVEs: in 2.39.6
- security CVE-2026-53488 in 2.39.6
- security CVE-2026-47262 in 2.39.6
- security Upgraded google.golang.org/grpc to 1.82.1 to address GHSA-hrxh-6v49-42gf in 2.39.6
- security Upgraded the Alpine base image from 3.23.4 to 3.24.1 to address OS-level package CVEs, including the jq advisories (CVE-2026-32316, CVE-2026-40164 and others) in 2.39.5
- security CVE-2026-53488 in 2.39.5
- security CVE-2026-53492 in 2.39.5
- security CVE-2026-53489 in 2.39.5
- security CVE-2026-47262 in 2.39.5
- security CVE-2026-50195 in 2.39.5
- security Fixes CVE-2026-55761: Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. In versions 2.39.0 t… in 2.39.4
- security CVE-2026-45570 in 2.39.4
- security CVE-2026-45571 in 2.39.4
- security GHSA-w5pp-99ch-qj29 in 2.39.4
- security CVE-2026-42504 in 2.39.4
- security CVE-2026-27145 in 2.39.4
- security CVE-2026-42499 in 2.39.4
- security CVE-2026-39836 in 2.39.4
- security CVE-2026-39820 in 2.39.4
- security CVE-2026-33814 in 2.39.4
- security CVE-2026-33811 in 2.39.4
- security CVE-2026-39826 in 2.39.4
- security CVE-2026-39823 in 2.39.4
- security CVE-2026-39825 in 2.39.4
- security CVE-2026-42507 in 2.39.4
Deprecations
- deprecated None in 2.45.2
- deprecated None in 2.45.1
- deprecated None in 2.40.0
- deprecated None in 2.39.8
- deprecated None in 2.39.7
- deprecated None in 2.39.5
Every release in between
otherOn Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot
otherPodman environments aren't supported by auto-onboarding script
featureIt's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
featureSupport for only CentOS 9, Podman 5 rootful
securityFixed a bypass of the "Hide bind mounts for non-administrators" setting. When it is enabled, Compose files deployed by non-administrators can no longer reference host files outside the stack directory (for example in configs, secrets or env_file), and include is disabled for them.
securityFixed a denied, failed or dry-run Kubernetes namespace deletion still removing Portainer's namespace access policies, stack records and registry bindings. These records are now removed only after Kubernetes accepts the deletion
securityFixed in-cluster HTTPS connections to the Kubernetes API server skipping TLS certificate verification during stack deploy and removal, on both the server and the agent
featureAdded a Node group column to the Kubernetes cluster node list for clusters using EKS, GKE, AKS, Karpenter or kops node pools, plus optional Instance type, Labels and Taints columns that can be turned on from the column menu
fixFixed the GitOps Sources page failing to load with "Object not found inside the database (bucket=workflows)" when a stack referenced a deleted workflow. Orphaned references are now skipped, and deleting a stack now unlinks it from its workflow in the same save
fixFixed deleting a Kubernetes stack with a namespace leaving behind objects whose manifest names no namespace
fixFixed Kubernetes Edge agents retrying removal of workload-less Edge stacks forever, which delayed new deployments and check-ins
fixFix the issue where the Docker dashboard volume count excludes volumes that restricted users have access to
fixFix the issue where the Async Edge dashboard includes container statistics for resources that Standard users cannot access
fixFix the issue where Compose stack undeploy operations do not respect the overall deployment timeout or cancellation context
fixFixed the default Unassigned environment group being renameable. It is now read-only, and a group that was already renamed can be reset to "Unassigned"
deprecatedNone
otherOn Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot
otherPodman environments aren't supported by auto-onboarding script
featureIt's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
featureSupport for only CentOS 9, Podman 5 rootful
securityHardened outbound requests against SSRF. Helm chart resolution and Git HTTP/HTTPS operations now go through the SSRF-aware transport, and the static rules that enforce this now match by type rather than by import alias, so an aliased import can no longer slip past them
otherCertificate-based authentication for Azure Blob backups is now disabled in FIPS mode
featureAdded build-time static analysis that catches FIPS violations before they ship
breakingRemoved unused non-FIPS code paths from FIPS builds
securityUpdated golang.org/x/mod to 0.40.0, fixing CVE-2026-56865 and CVE-2026-56864
securityUpdated golang.org/x/crypto to 0.56.0, fixing CVE-2026-56854 (High), CVE-2026-78662 and CVE-2026-56855
securityUpdated google.golang.org/grpc to 1.83.2, fixing CVE-2026-84304
securityUpdated kubectl in the kubectl shell image to v1.37.0, which removes golang.org/x/net 0.49.0 entirely — fixing CVE-2026-39821 (Critical) along with 2 High and 5 Medium findings
securityUpdated helm in the kubectl shell image to v4.2.4, taking golang.org/x/net to 0.56.0 and fixing CVE-2026-46600 (High)
securityUpgraded the Alpine packages in the kubectl shell image, taking openssl/libssl3 to 3.5.8-r0, libcurl to 8.22.0-r0 and jq to 1.8.2-r0. Clears 2 Critical findings (CVE-2026-63073 and CVE-2026-75803) plus 9 High, 11 Medium and 1 Low
otherSimplified the stat cards on the environment list
otherRenamed the GitOps “Edit git settings” button to “Edit stack settings”, which reflects what it actually changes
otherThe --secret-key-name help text now documents the BE secret path as well as the CE one
fixFixed the Swarm network list failing to render, showing “Cannot read properties of undefined (reading 'NodeRole')” and staying empty even after a network was created
fixFixed the node details Applications section listing pods that are not running on that node
fixFixed a registry personal access token continuing to be used after it was changed. The Helm registry cache is now flushed when credentials change
fixFixed the Edge Updater status page failing to load because of a broken status sort
featureAdded an info box to Edge stacks explaining that the GitOps source polling interval does not apply to them
deprecatedNone
featureIt's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
featureSupport for only CentOS 9, Podman 5 rootful
featureAdded advanced Kubernetes node drain options with agent failover
featureAdded native Portainer APIs for writing Kubernetes secrets, configmaps, deployments and persistent volume claims, replacing direct kube-apiserver proxy calls
featureAdded a generic Kubernetes manifest dry-run API
featureEdge Compute settings can now be configured during initial setup and via cli flags
featureAuthentication events now record the real client IP from X-Forwarded-For when the request comes through a trusted proxy
featureThe namespace YAML tab now shows every resource quota in the namespace
featureAdded GetCharts() support to the async Edge agent, so chart data syncs on agent startup
featureEdge agent connectivity checks now report progress while probing, and wait longer before failing
featureCreating a git source now skips the source type selection step
featureThe source form now explains git polling versus webhook triggers, and exposes the polling interval setting that was missing from the UI
featureRemoved the redundant single-tab handle from the workflow details view
featureReworded the registry creation tooltip to make the default behaviour obvious
featureClarified that Portainer supports Podman through its Docker-compatible API only
securityFixed a critical Docker proxy authorization bypass. Unrecognised API version prefixes like /v1.47.0/ or /v01.47/ skipped access control entirely, letting non-admin users reach the Docker API directly
securityClosed a remaining gap in the CVE-2026-44849 (GHSA-5fxq-qcf3-244w) fix and broadened bind-mount restrictions for non-admin users, now including Compose and Swarm stack deployments
securitySingle-namespace Kubernetes endpoints now check the caller’s namespace authorization instead of running as admin
securityRead-only and Helpdesk users can no longer view Kubernetes secret data
securityStandard users can no longer manage registry access
securityKubernetes authorization denials now return HTTP 403 instead of 500
securityFixed a Kubernetes shell authorization flaw. Caller-supplied query parameters could override the server's pod target, letting a standard user run commands in any pod on Agent-managed Kubernetes environments
securityUpdated the Go toolchain to 1.26.6, fixing CVE-2026-39821 (Critical, 9.6), an IDNA validation bypass of hostname-based access controls, along with CVE-2026-42505, CVE-2026-39822, CVE-2026-56862, CVE-2026-56860, CVE-2026-56859, CVE-2026-56858, CVE-2026-56853, CVE-2026-46600 and CVE-2026-33818
securityUpdated oras.land/oras-go/v2 to 2.6.2, fixing CVE-2026-50163
securityUpdated github.com/go-git/go-git/v5 to 5.19.2, fixing CVE-2026-71556 and CVE-2026-71557
securityUpdated go.opentelemetry.io/otel to 1.44.0, fixing CVE-2026-41178
securityUpdated github.com/klauspost/compress to 1.18.7, fixing GHSA-259r-337f-4rfw
securityUpgraded libcurl to 8.21.0-r0 in the kubectl-shell image to address the following CVEs: CVE-2026-11856, CVE-2026-10536, CVE-2026-11564, CVE-2026-12064, CVE-2026-11586, CVE-2026-11352, CVE-2026-9547, CVE-2026-9546, CVE-2026-9545, CVE-2026-9080, CVE-2026-9079, CVE-2026-8932, CVE-2026-8927,…
securityUpgraded c-ares to 1.34.8-r0 in the kubectl-shell image to address CVE-2026-33630
fixRemoving a stack now uninstalls the underlying Helm release, which used to be left running
fixFixed Edge stack workloads staying up after deletion on Kubernetes. The entry file and namespace are now sent on removal
fixFixed collisions during Edge stack removal and reassignment. The old stack is now removed before the new one deploys
fixFixed Lstat /data/edge_stacks//v1: no such file or directory on Kubernetes async agents by persisting the artifact commit hash before creating the Edge stack
fixFixed Azure Blob backup settings not saving, by resolving redacted credentials on write
fixFixed manual team-membership sync diverging from login-time sync by sharing a single implementation
fixFixed server-managed API key metadata fields being wiped on policy update
fixFixed spaces in setup policy names causing Kubernetes label errors
fixFixed the Policies card on the Kubernetes dashboard not counting all applied policy types
fixPolicy operations now return a meaningful error when the policy isn’t found, instead of a bare 404
securityDu Feilong () and Jerry () - added Docker --security-opt support and Swarm cluster self-heal after manager reap
+17 more items in the release notesfeatureIt's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
featureSupport for only CentOS 9, Podman 5 rootful
featureAdded a basic workflow details screen
featureAdded GPU visibility in the Environment Details view
featureMade the Portainer setup token easier to spot in the installation logs
featureTracked the Source, Workflow, and Artifact status persistently
featureUpgraded bbolt to v1.5.0 for performance and robustness improvements
featureMoved the build pipeline to BuildKit v0.31.2 (previously v0.27.0); image build provenance attestations moved to the SLSA v1.0 format (previously v0.2) — any tooling that parses attestations needed to be verified against the new format
securityFixed unauthorized access via leftover service accounts
securityFixed path traversal in the swarm compose deployer, where configs/secrets file paths escaped the project root
securityCVE remediation:
securityUpgraded oras.land/oras-go/v2 to 2.6.1 to remediate CVEs
securityUpgraded containerd to 1.7.33 / v2 2.2.5 to remediate CVEs
securityUpgraded google.golang.org/grpc to 1.82.1 to remediate GHSA-hrxh-6v49-42gf
securityUpgraded axios to 1.18.0 to remediate CVEs
securityUpgraded shell-quote to 1.8.4 to remediate CVEs
fixFixed the "This node is not a swarm manager" error message when running inside a swarm
fixFixed image builds failing to authenticate against private registries in FROM lines by allowing the X-Registry-Config header through the proxy
fixFixed a team with valid access not appearing in Config access control while another team with identical access was visible
fixFixed AD/LDAP settings defects where special characters were stripped, the username format selection was invisible, the root domain was unpopulated, and the delete button was broken
fixFixed an issue where [object Object] appeared as an element name on the Alerting page
fixFixed a problem that caused sources to fail to load
fixBrought back shared Git credentials for GitOps Sources
fixFixed an issue where a space-delimited list of scopes wasn't correctly requesting access to resources on the user's behalf, so the Google consent screen didn't show the expected permissions
fixFixed the poll frequency selection dropdown staying on the default value
fixFixed RBAC policy's datatable namespace input
fixFixed the forced polling usage in Git sources
fixFixed Helm chart uninstall showing cosmetic errors only
fixFixed the tooltip rendering for environment variables in Portainer Application Templates
fixFixed the Ingress service port number being displayed as 0 instead of the configured value
fixFixed Kubernetes manifest deployments reporting success but silently failing when "Use namespace from manifest" was disabled
fixFixed an output mismatch in the Kubectl shell between BE and CE
fixFixed an issue where logout caused an infinite page reload
fixFixed a missing source in the list until refresh
fixFixed non-admin redeploy failing when numeric environment variables were quoted in a stack (invalid containerPort)
fixFixed Portainer STS 2.42.0 showing "1 Agent needs upgrading" when none did
fixFixed Docker stack deployments that exceeded the 15-minute timeout remaining stuck in the "Deploying" state and blocking further redeployments
fixFixed RBAC policies not creating RoleBindings for grants with no namespace list (e.g. Operator, Helpdesk)
fixFixed re-assigning an edge group to an edge stack bringing back old state
fixFixed a regression where relative env_file: in Git sub-directory stacks resolved from the project root instead of the compose file's directory
+14 more items in the release notessecurityFixes CVE-2026-55761: Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. In versions 2.39.0 t…
featureIt's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
featureSupport for only CentOS 9, Podman 5 rootful
featureGitOps Sources: new Source Creation wizard, Source Detail screen and Source editing, with reuse of existing sources when adding Docker repository stacks and Kubernetes Helm-from-git installs
featureDisplay cached container images per node on Kubernetes
featureIn-product installation flow for KubeSolo-based single-node edge deployments
featureKubernetes application list and pod logs now default to expanded
featureEnvironment Group Detail View updated with a new sortable-list-based group list UI
securityAdded a one-time setup token, printed to the server logs at startup, that is required to create the first administrator account or restore a backup on a new, uninitialised instance.
securityImplemented an SSRF protection mechanism with a configurable allow-list in settings (off / audit / enforce modes)
securityAdded an endpoint authorization check to /api/kubernetes/{id}/* routes, preventing users with no access from enumerating Kubernetes resources
securityFixed custom-template user-access checks that bypassed the Resource Control definition, allowing edit/inspect/delete authorization to ignore admins-only / public / team grants
securityFilter GET namespace results by the user's allowed-namespace list, returning Forbidden for namespaces the user cannot access
securityBumped golang.org/x/net to v0.55.0 for the following CVEs:
securityCVE-2026-39821, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-42502, CVE-2026-42506
securityBumped golang.org/x/crypto to v0.52.0 for the following CVEs:
securityCVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-42508, CVE-2026-46595
securityBumped go.opentelemetry.io/otel to v1.43.0 for the following CVEs:
securityCVE-2026-39882, CVE-2026-39883
securityBumped github.com/go-git/go-git/v5 to v5.19.1 for the following CVEs:
securityCVE-2026-45571, GHSA-w5pp-99ch-qj29, CVE-2026-45570
securityBumped Go stdlib to 1.26.4 for the following CVEs:
securityCVE-2026-42504, CVE-2026-27145, CVE-2026-42507
securityBumped Go to 1.26.3 for the following CVEs:
securityCVE-2026-42499, CVE-2026-39836, CVE-2026-39820, CVE-2026-33814, CVE-2026-33811, CVE-2026-39826, CVE-2026-39823, CVE-2026-39825
securityBumped containerd to 1.7.32 and containerd/v2 to 2.2.4 for the following CVEs:
securityCVE-2026-46680
securityUpgraded the kubectl-shell Helm SDK to helm/v4 4.1.4 for the following CVEs:
securityCVE-2026-35204, CVE-2026-35205
fixFixed edge stacks that could not be deployed (Helm file-path cleared incorrectly)
fixFixed a ZodError (edgeStackId invalid input) when deploying an edge stack from a private repo to a group
fixFixed "Invalid option: expected one of 1|2" error for environments in the waiting room
fixFixed edge agent poll-handler timeouts and deadlocks; stale tunnels are now cleaned up immediately
fixFixed webhook POST returning 404 "Unable to find a webhook with this token" (webhook ID creation in the frontend)
fixFixed Git auto-update polling failures for regular stacks caused by a cancelled deployment context
fixStandard users with access permission can again browse and delete private registry images (2.39.2 regression)
fixFixed a 500 error on stack deploy/update when an invalid ECR registry is present; ECR token pre-validation errors now log a warning instead
fixNetworks assigned to a Docker Swarm service at creation time are now correctly applied to the created service
fixRestored YAML syntax highlighting in the web editor
fixImproved performance of the image up-to-date status indicator; the UI no longer becomes slow/unresponsive on environments with many containers
+18 more items in the release notesfeatureSupport for only CentOS 9, Podman 5 rootful.
securityRemoval of legacy CSRF fallback (scheduled). The legacy-csrf feature flag, introduced in 2.41 as a temporary migration aid, has been removed as scheduled. Users still relying on this flag must resolve any CSRF configuration issues before upgrading (see the 2.41 breaking changes for details). This…
featureAdded theme selector to the user menu, allowing switching between light, dark, and high-contrast themes without navigating to settings.
featureAdded GitOps sources list view and source detail view for managing Git sources used in deployments.
featureAdded a connectivity test before adding edge environments.
featureAdded Docker host disk usage display to the host details view.
featureReplaced Kubernetes Volume view with 3 new tables for PV, PVC, SC (PersistentVolumes, PersistentVolumeClaims, StorageClasses).
featureAdded link ability between Kubernetes secrets and service account image pull secrets for private registry access.
featureAdded pod restart and pod delete support on the Kubernetes application details page.
featureImproved Application Container list, separated pod info from containers list.
featurePorted Swarm stack deployments to use libstack, eliminating the embedded Docker binary from CE/BE images.
featureAdded support for volumes-only mount paths in the agent, enabling environments where Docker volumes are accessible via non-default mount paths.
featureAdded missing snapshot collection for Edge Agents with long running Chisel connections.
securityFixed Docker exec endpoint to enforce container resource controls, preventing unauthorized exec access to containers.
securityFixed Docker proxy to enforce resource controls on /containers/{id}/attach/ws WebSocket endpoint.
securityFixed URL path rewriting to clear the RawPath field, preventing path traversal via percent-encoded paths.
securityChanged a default setting to enforce server-side EdgeID on first connection.
securityAuthentication cookies now have the Secure attribute set automatically when Portainer is accessed over HTTPS.
securityUpgraded golang.org/x/net to v0.54.0 to address CVE-2026-27141 and CVE-2026-33814.
securityUpgraded github.com/go-git/go-git/v5 to v5.19.0 to address CVE-2026-34165, GHSA-3xc5-wrhm-f963, and CVE-2026-33762.
securityUpgraded github.com/in-toto/in-toto-golang to v0.11.0 to address GHSA-pmwq-pjrm-6p5r.
securityUpgraded github.com/Azure/go-ntlmssp to v0.1.1 to address CVE-2026-32952.
securityUpgraded github.com/prometheus/prometheus to v0.311.3 to address CVE-2026-40179, GHSA-fw8g-cg8f-9j28, and CVE-2026-42151.
fixFixed TLS configuration being accepted for Edge Agent environments via API (TLS is now correctly rejected for Edge Agent environment creation and updates).
fixFixed stack deployments hanging due to deadlock during ECR token refresh under concurrent stack deployments.
fixFixed Chisel panic caused by a negative WaitGroup counter.
fixFixed stack images being pulled in parallel causing rate-limiting failures; images are now pulled sequentially and COMPOSE_PARALLEL_LIMIT is respected.
fixFixed GitOps polling stopping permanently after a deployment error; auto-update now resumes correctly on subsequent polling cycles.
fixFixed GitOps auto-update skipping re-deployment when the commit hash was persisted before the deployment attempt; the hash is now only written after the deploy status is saved.
fixFixed an issue where editing a private git stack required re-entering credentials due to incorrect form validation and missing stack ID in gitops API calls.
fixFixed “Stack ID required” error appearing when viewing logs for containers not part of a stack.
fixFixed re-pull and redeploy operation to use the compose service for image pulling.
fixFixed kubectl-shell-image flag only taking effect on the first Portainer run; the flag is now re-applied on each restart.
fixFixed Kubernetes application edit buttons not working for Git-managed applications.
fixFixed effective access viewer not including policies when calculating user access.
fixFixed volume browsing failure when Docker data root is set to a non-default path.
fixFixed incorrect OS labels for edge agent and Docker API environments (Linux/Windows labels now aligned).
fixFixed change confirmation dialog incorrectly appearing during Helm deployment creation.
fixFixed Edge environment URLs displayed on the home page incorrectly showing the Portainer server URL; the URL is now hidden on the list view and the server/tunnel URLs are shown on the environment detail panel instead.
breakingRemoved OpenAMT integration.
+7 more items in the release notesotherOn Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot
otherPodman environments aren't supported by auto-onboarding script
featureIt's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
featureSupport for only CentOS 9, Podman 5 rootful
featureAdded Age as a sort option on the Home environments list and made it the default sort order, with "Oldest" (ascending by environment ID) and "Newest" (descending) toggles
fixFixed the Talos Cluster Details page rendering blank by reverting the Omni cluster phase fields to int32 so they match the frontend OmniClusterPhase / OmniClusterUpgradePhase enum contract
securityFixes CVE-2026-44883: Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to befor…
featureSupport for only CentOS 9, Podman 5 rootful
breakingPortainer fails to start with a fatal log entry like failed to build server | error="invalid url for trusted origin... trusted_origin: \"portainer.example.com\"". The new implementation requires each entry in the trusted origins list to be a full URL including scheme (e.g.…
breakingBrowser requests return 403 Forbidden on state-changing actions, with CSRF check failed entries in the server logs. This means the browser's origin is not in the trusted origins list and needs to be added.
featureAdded support for deploying Helm chart edge stacks sourced from Helm repositories and Git repositories.
featureReworked Docker stack creation and deployment to an async flow for consistent behaviour with Compose.
featureKubernetes Manifest GitOps stacks can now be edited after deployment — admins can update the Git repository URL, reference, manifest filename, and credentials from the application detail view instead of tearing down and recreating the stack.
featureAdded TUI (text-based UI) application support to the Web Console and kubectl shell, including proper terminal resize handling.
featureAdded a "Redeploy" button to the Git-backed stack detail view for pulling and redeploying from the repository.
featureAdded visible rendering of special and non-printable characters in the web code editor.
featureAdded Edit YAML and Describe actions to Services, Jobs, CronJobs, Roles, RoleBindings, ClusterRoles, and ClusterRoleBindings datatables in the Kubernetes UI.
featureAdded support for pruning unused Docker images from the Images list, with a confirmation modal.
featureRefreshed the navigation bar and page header styling.
featureAdded a registry-access notice on Kubernetes app create/edit and Helm install/upgrade views to guide users to configure registry access.
featureAdded a GitOps Workflows page — a new top-level sidebar item that lists every GitOps workflow across environments and edge stacks with a status summary bar, sortable list, and cross-jump to each stack's edit view. The backing API is RBAC-aware: admins see everything; Edge admins see Edge-stack…
featureAdded custom namespace support when deploying Helm-based edge stacks.
featureHome UI improvements to highlight environment groups.
securityBumped Go toolchain to 1.26.2 to remediate the following CVEs:
securityCVE-2026-32280 (crypto/x509 excessive chain-building work in Verify, denial of service)
securityCVE-2026-32281 (crypto/x509 inefficient policy validation, denial of service)
securityCVE-2026-32283 (crypto/tls 1.3 key update deadlock, uncontrolled resource consumption)
securityCVE-2026-33810 (crypto/x509 excluded DNS constraints not applied to wildcard domains in different case)
securityBumped helm.sh/helm/v4 to v4.1.4 to remediate the following CVEs:
securityCVE-2026-35204 (plugin version path traversal enables arbitrary file write; GHSA-vmx8-mqv2-9gmg)
securityCVE-2026-35205 (plugin missing-provenance signature-verification bypass; GHSA-q5jf-9vfq-h4h7)
securityBumped github.com/moby/spdystream to v0.5.1 to remediate CVE-2026-35469.
securityUpgraded the bundled Docker binary from v29.3.0 to v29.4.1 (agent, server-ce, server-ee, compose-unpacker), picking up Go 1.25.8 and 1.25.9 to mitigate the following CVEs:
securityCVE-2026-25679
securityCVE-2026-27142
securityCVE-2026-27139
securityCVE-2026-32280
securityCVE-2026-32281
securityCVE-2026-32283
securityCVE-2026-32282
securityCVE-2026-32289
securityCVE-2026-32288
fixFixed keyword search failing to highlight matches in application and container log views.
fixFixed several data races in Kubernetes environment detection by switching to transactional code.
fixFixed a use-after-close data race in the endpoint force-update service.
fixCached the MOTD on the server to eliminate a banner-related layout shift on page load.
+27 more items in the release notesfeatureIt's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
featureSupport for only CentOS 9, Podman 5 rootful
featureAdded an information panel showing current and planned GitOps deployment details when a Git URL or config path is changed
featureDocker Compose GitOps stacks can now have their Git URL, config path, and entry point edited after creation
featureCleaned up Git authentication token handling — GitHub tokens can now be entered directly in the Token field rather than the Basic auth field
featureAdded a -remove-orphans / prune option when deploying Docker Compose stacks
featureAdded support for -security-opt when creating Docker containers
featureUpgraded Helm Go SDK to v4
featureUpgraded Kubernetes dependencies to v1.35
securityUpgraded CIRCL library to v1.6.3 to fix GO-2026-4550 incorrect secp384r1 CombinedMult calculation
securityUpgraded go-git to v5.17.0 to fix GO-2026-4473 improper verification of data integrity for .idx and .pack files
securityUpgraded OpenTelemetry Go SDK to v1.41.0 to fix GO-2026-4394 arbitrary code execution via PATH hijacking vulnerability
securityUpgraded OpenTelemetry SDK to v1.42.0 to fix CVE-2026-24051
securityUpgraded Docker binary to v29.3.0 to mitigate CVE-2025-68121
securityBumped golang-jwt/jwt/v4 to v4.5.2 to fix CVE-2025-30204 regression
securityUpgraded gRPC to v1.79.3 to fix CVE-2026-33186
securityFixed missing authorization check on the Custom Template file content API endpoint
fixFixed GitOps Edge Configurations not restarting the correct service when a bind-mounted configuration file changes
fixFixed Git reference (branch/tag/commit) input field not working in GitOps forms
fixFixed container incorrectly shown as running in the UI while Docker reports it as restarting or removing
fixFixed stack update/edit button remaining clickable during form submission
fixFixed Git-based Docker stacks from GitLab failing environment variable validation for non-admin users
fixFixed Helm Edge stacks being incorrectly marked as External Edge stacks
fixFixed Portainer console freezing when pasting more than 2000 characters
fixFixed TLS certificate upload failing when updating environment connection settings
fixFixed deleting a Kubernetes Edge stack causing the environment to appear as offline
fixFixed LDAP DN builder not accepting dashes in field values
fixFixed "Edit This Application" button being disabled for non-admin users on the Kubernetes application details page
fixFixed Docker Swarm Overlay Network issues causing "Unable to find an agent on any manager node" errors
fixFixed environment selector crashing after upgrade when a group referenced in a stack no longer exists
fixFixed not all containers for a Swarm service being shown
fixFixed blank dashboard appearing after upgrade to 2.39.0 caused by a panic in the UAC evaluation for external stacks
fixFixed container view failing with "Unable to retrieve registries: Unauthorized" for non-admin users
fixFixed race condition in stack update function registration that could cause internal state corruption
fixFixed WebSocket data race in logout handling
fixImproved PostInitMigrate() performance from O(N²) to O(N log N)
fixFixed OAuth login failing when the OAuth provider returns a malformed Content-Type header (affects providers such as Cloudflare Access)
fixFixed log lines that are JSON-encoded strings rendering as character-index pairs instead of the actual log text
fixAligned Axios error message display in CE with the EE implementation
deprecatedNone
+2 more items in the release notesotherOn Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot
otherPodman environments aren't supported by auto-onboarding script
featureIt's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
featureSupport for only CentOS 9, Podman 5 rootful
otherUpgraded the Go toolchain from 1.25.12 to 1.25.14 to address the following CVEs:
securityCVE-2026-39821
securityCVE-2026-56862
securityCVE-2026-56859
securityCVE-2026-56853
securityCVE-2026-33818
securityCVE-2026-56858
securityCVE-2026-56860
otherUpgraded golang.org/x/mod to 0.40.0 to address the following CVEs:
securityCVE-2026-56865
securityCVE-2026-56864
otherUpgraded golang.org/x/crypto to 0.55.0 in Portainer CE and compose-unpacker, which had lagged behind the other modules, to address GO-2026-6303
securityUpgraded kubectl in the kubectl shell image from 1.36.2 to 1.37.0, which is built with Go stdlib 1.26.6 and vendors golang.org/x/net 0.57.0, clearing 2 Critical findings (including CVE-2026-39821), 7 High and 7 Medium
otherUpgraded the Alpine packages in the kubectl shell image, moving openssl/libssl3 to 3.5.8-r0 and jq to 1.8.2-r0, clearing a further 9 High, 10 Medium and 1 Low findings
fixFixed the Portainer updater reporting a container as healthy when its health-check command had never actually run, which could cause a failed upgrade to skip its rollback. The updater now waits for the exec session to complete before reading its exit code
deprecatedNone
otherOn Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot
otherPodman environments aren't supported by auto-onboarding script
featureIt's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
featureSupport for only CentOS 9, Podman 5 rootful
fixFixed a critical Docker proxy authorization bypass. Unrecognised API version prefixes like /v1.47.0/ or /v01.47/ skipped access control entirely, letting non-admin users reach the Docker API directly
securityClosed a remaining gap in the CVE-2026-44849 (GHSA-5fxq-qcf3-244w) fix and broadened bind-mount restrictions for non-admin users, now including Compose and Swarm stack deployments
deprecatedNone
otherOn Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot
otherPodman environments aren't supported by auto-onboarding script
featureIt's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
featureSupport for only CentOS 9, Podman 5 rootful
securityImplemented an SSRF protection mechanism with a configurable allow-list in settings (off / audit / enforce modes)
securityChanged a default setting to enforce server-side EdgeID on first connection
securityFixed path traversal in the swarm compose deployer, where configs/secrets file paths escaped the project root
securityUpgraded the Go toolchain from 1.25.11 to 1.25.12 to address the following CVEs:
securityCVE-2026-42505
securityCVE-2026-39822
securityUpgraded github.com/go-git/go-git/v5 to 5.19.2 to address the following CVEs:
securityCVE-2026-71556
securityCVE-2026-71557
securityUpgraded oras.land/oras-go/v2 to 2.6.2 to address CVE-2026-50163
securityUpgraded go.opentelemetry.io/otel to 1.44.0 to address CVE-2026-41178
securityUpgraded github.com/klauspost/compress to 1.18.7 to address GHSA-259r-337f-4rfw
securityUpgraded golang.org/x/net to 0.56.0 and golang.org/x/text to 0.39.0 in the Portainer updater to address the following CVEs:
securityCVE-2026-46600
securityCVE-2026-56852
securityUpgraded github.com/containerd/containerd (v1) to 1.7.33 to address the following CVEs:
securityCVE-2026-53488
securityCVE-2026-47262
securityUpgraded google.golang.org/grpc to 1.82.1 to address GHSA-hrxh-6v49-42gf
fixFixed a user's direct environment access being incorrectly removed when a team they belonged to was deleted
fixFixed multiple "Cannot read properties of undefined (reading 'message')" error toasts appearing on Kubernetes application pages when an API call failed without a response (e.g. while pods are restarting after a redeploy)
fixFixed an "Invalid Swarm ID" / 503 error when creating a stack from a Swarm worker node
fixFixed Kubernetes Ingress service ports always showing 0
fixFixed kubectl port-forward failing with "error upgrading connection" against Agent 2.35+ on older Kubernetes clusters
fixFixed "This node is not a swarm manager" errors when starting/stopping a Swarm stack from within the swarm itself
fixFixed Docker image builds failing with unauthorized against private registries referenced in a Dockerfile's FROM line (both the UI's "Build a new image" flow and the /docker/build API proxy)
fixFixed Swarm stack deployments failing to re-pull private Docker Hub images on a forced re-pull, even with valid registry credentials configured
fixFixed request-handler panics being logged as unexpected crashes when a client disconnected mid-request (e.g. a long-poll on a Kubernetes Jobs watch)
otherOn Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot
otherPodman environments aren't supported by auto-onboarding script
featureIt's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
featureSupport for only CentOS 9, Podman 5 rootful
fixFixed a 2.39.4 regression where a relative env_file: in a Git stack whose compose file lives in a repository sub-directory was resolved against the project root instead of the compose file's own directory, deploying stacks with an empty environment or failing outright
featureImproved Edge tunnel reliability over high-latency links (satellite/VSAT): the server no longer tears down a half-established tunnel on timeout, keep-alive and unlimited background retries were added on the agent, and the ping timeout was raised from 3s to 8s
fixFixed standard users not seeing all of their teams in access control selectors (e.g. when restricting access on a newly created Docker Config), caused by FilterUserTeams incorrectly dropping teams
fixFixed deleting images from the Swarm image list only removing them from a single node instead of every node they exist on
fixFixed a potential block where a Docker stack deployment exceeding the internal 15-minute timeout left the stack stuck in "Deploying" status, preventing further redeployments
fixFixed the environment details view always showing the default poll frequency for Edge environments instead of the saved value
securityUpgraded the Alpine base image from 3.23.4 to 3.24.1 to address OS-level package CVEs, including the jq advisories (CVE-2026-32316, CVE-2026-40164 and others)
otherUpgraded github.com/containerd/containerd/v2 to 2.2.5 to address the following CVEs:
securityCVE-2026-53488
securityCVE-2026-53492
securityCVE-2026-53489
securityCVE-2026-47262
securityCVE-2026-50195
deprecatedNone
securityFixes CVE-2026-55761: Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. In versions 2.39.0 t…
otherOn Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot
otherkubectl port-forward fails with Portainer kubeconfig in some configurations
otherPodman environments aren't supported by auto-onboarding script
featureIt's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
featureSupport for only CentOS 9, Podman 5 rootful
featureAdded an API endpoint to refresh Team/Group membership for a user
fixFixed an issue where users with no environment access are able to enumerate Kubernetes resources
fixFixed ecr token pre-validation error with warning log
fixFixed the way a standard user could not redeploy team stack or delete registry image
fixFixed the restore endpoint allowing admin takeover for uninitialised Portainer instances
fixFixed link on timed out page
otherReplaced docker binary with libstack
fixFixed the volume label dropdown becoming blank
otherBump go-git to 5.19.1 to address the following CVEs:
securityCVE-2026-45570
securityCVE-2026-45571
securityGHSA-w5pp-99ch-qj29
otherBumped go stdlib to 1.25.11 to remediate the following stdlib CVEs:
securityCVE-2026-42504
securityCVE-2026-27145
securityCVE-2026-42499
securityCVE-2026-39836
securityCVE-2026-39820
securityCVE-2026-33814
securityCVE-2026-33811
securityCVE-2026-39826
securityCVE-2026-39823
securityCVE-2026-39825
securityCVE-2026-42507