Portainer 2.42.0 → 2.45.3
6 releases · 2 breaking changes · 62 security fixes · 1 advisory fixed
62security2breaking2deprecated39feature62fix
Vulnerabilities fixed by this upgrade
- 5.9 CVE-2026-55761 Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. In versions 2.39.0 t…
Breaking changes
- breaking Removed unused non-FIPS code paths from FIPS builds in 2.45.1
- breaking Provision KaaS Cluster feature in 2.43.0
Security changes
- security Portainer no longer trusts TLS certificates issued by eMudhra (emSign), following the compromise of eight eMudhra intermediate CAs (CVE-2026-111943). Connections to services that present an affected certificate, including OAuth/OIDC and LDAPS providers, registries and Git hosts, will fail after… in 2.45.3
- security Rejected Compose and Swarm stacks using volumes_from when non-administrators create, update, start or redeploy them with Hide bind mounts for non-administrators enabled, which let them inherit another container's host bind mounts in 2.45.3
- security Updated the Go toolchain to 1.26.10, fixing CVE-2026-56857 and CVE-2026-78663 (both Critical), along with CVE-2026-111943, CVE-2026-97032, CVE-2026-97031, CVE-2026-94440, CVE-2026-94439, CVE-2026-78669, CVE-2026-78667, CVE-2026-78660, CVE-2026-78659, CVE-2026-56866, CVE-2026-94448 and CVE-2026-97030 in 2.45.3
- security Removed the eMudhra emSign root certificates from the CA bundle in Linux images, and rejected certificate chains that contain the compromised eMudhra intermediates (CVE-2026-111943). See this FAQ for details. in 2.45.3
- security Updated golang.org/x/net to 0.60.0, fixing CVE-2026-78663 (Critical), CVE-2026-97032, CVE-2026-78669, CVE-2026-78660 and CVE-2026-78659 (all High) in 2.45.3
- security Updated helm in the kubectl shell image to v4.3.1, taking its Go toolchain to 1.27.2 and oras.land/oras-go/v2 to 2.6.2, fixing CVE-2026-39821 (Critical) and CVE-2026-50163 (High) in 2.45.3
- security Restricted kubeconfig tokens to the /api/endpoints/{id}/kubernetes proxy, so they are rejected with a 403 on every other API route, including admin-only routes and the Docker proxy. Kubeconfigs downloaded after upgrading carry a separate token per environment, limited to that environment in 2.45.3
- security Fixed a bypass of the "Hide bind mounts for non-administrators" setting. When it is enabled, Compose files deployed by non-administrators can no longer reference host files outside the stack directory (for example in configs, secrets or env_file), and include is disabled for them. in 2.45.2
- security Fixed a denied, failed or dry-run Kubernetes namespace deletion still removing Portainer's namespace access policies, stack records and registry bindings. These records are now removed only after Kubernetes accepts the deletion in 2.45.2
- security Fixed in-cluster HTTPS connections to the Kubernetes API server skipping TLS certificate verification during stack deploy and removal, on both the server and the agent in 2.45.2
- security Hardened outbound requests against SSRF. Helm chart resolution and Git HTTP/HTTPS operations now go through the SSRF-aware transport, and the static rules that enforce this now match by type rather than by import alias, so an aliased import can no longer slip past them in 2.45.1
- security Updated golang.org/x/mod to 0.40.0, fixing CVE-2026-56865 and CVE-2026-56864 in 2.45.1
- security Updated golang.org/x/crypto to 0.56.0, fixing CVE-2026-56854 (High), CVE-2026-78662 and CVE-2026-56855 in 2.45.1
- security Updated google.golang.org/grpc to 1.83.2, fixing CVE-2026-84304 in 2.45.1
- security Updated kubectl in the kubectl shell image to v1.37.0, which removes golang.org/x/net 0.49.0 entirely — fixing CVE-2026-39821 (Critical) along with 2 High and 5 Medium findings in 2.45.1
- security Updated helm in the kubectl shell image to v4.2.4, taking golang.org/x/net to 0.56.0 and fixing CVE-2026-46600 (High) in 2.45.1
- security Upgraded the Alpine packages in the kubectl shell image, taking openssl/libssl3 to 3.5.8-r0, libcurl to 8.22.0-r0 and jq to 1.8.2-r0. Clears 2 Critical findings (CVE-2026-63073 and CVE-2026-75803) plus 9 High, 11 Medium and 1 Low in 2.45.1
- security Fixed a critical Docker proxy authorization bypass. Unrecognised API version prefixes like /v1.47.0/ or /v01.47/ skipped access control entirely, letting non-admin users reach the Docker API directly in 2.45.0
- security Closed a remaining gap in the CVE-2026-44849 (GHSA-5fxq-qcf3-244w) fix and broadened bind-mount restrictions for non-admin users, now including Compose and Swarm stack deployments in 2.45.0
- security Single-namespace Kubernetes endpoints now check the caller’s namespace authorization instead of running as admin in 2.45.0
- security Read-only and Helpdesk users can no longer view Kubernetes secret data in 2.45.0
- security Standard users can no longer manage registry access in 2.45.0
- security Kubernetes authorization denials now return HTTP 403 instead of 500 in 2.45.0
- security Fixed a Kubernetes shell authorization flaw. Caller-supplied query parameters could override the server's pod target, letting a standard user run commands in any pod on Agent-managed Kubernetes environments in 2.45.0
- security Updated the Go toolchain to 1.26.6, fixing CVE-2026-39821 (Critical, 9.6), an IDNA validation bypass of hostname-based access controls, along with CVE-2026-42505, CVE-2026-39822, CVE-2026-56862, CVE-2026-56860, CVE-2026-56859, CVE-2026-56858, CVE-2026-56853, CVE-2026-46600 and CVE-2026-33818 in 2.45.0
- security Updated oras.land/oras-go/v2 to 2.6.2, fixing CVE-2026-50163 in 2.45.0
- security Updated github.com/go-git/go-git/v5 to 5.19.2, fixing CVE-2026-71556 and CVE-2026-71557 in 2.45.0
- security Updated go.opentelemetry.io/otel to 1.44.0, fixing CVE-2026-41178 in 2.45.0
- security Updated github.com/klauspost/compress to 1.18.7, fixing GHSA-259r-337f-4rfw in 2.45.0
- security Upgraded libcurl to 8.21.0-r0 in the kubectl-shell image to address the following CVEs: CVE-2026-11856, CVE-2026-10536, CVE-2026-11564, CVE-2026-12064, CVE-2026-11586, CVE-2026-11352, CVE-2026-9547, CVE-2026-9546, CVE-2026-9545, CVE-2026-9080, CVE-2026-9079, CVE-2026-8932, CVE-2026-8927,… in 2.45.0
- security Upgraded c-ares to 1.34.8-r0 in the kubectl-shell image to address CVE-2026-33630 in 2.45.0
- security Du Feilong () and Jerry () - added Docker --security-opt support and Swarm cluster self-heal after manager reap in 2.45.0
- security Fixed unauthorized access via leftover service accounts in 2.44.0
- security Fixed path traversal in the swarm compose deployer, where configs/secrets file paths escaped the project root in 2.44.0
- security CVE remediation: in 2.44.0
- security Upgraded oras.land/oras-go/v2 to 2.6.1 to remediate CVEs in 2.44.0
- security Upgraded containerd to 1.7.33 / v2 2.2.5 to remediate CVEs in 2.44.0
- security Upgraded google.golang.org/grpc to 1.82.1 to remediate GHSA-hrxh-6v49-42gf in 2.44.0
- security Upgraded axios to 1.18.0 to remediate CVEs in 2.44.0
- security Upgraded shell-quote to 1.8.4 to remediate CVEs in 2.44.0
- security Fixes CVE-2026-55761: Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. In versions 2.39.0 t… in 2.43.0
- security Added a one-time setup token, printed to the server logs at startup, that is required to create the first administrator account or restore a backup on a new, uninitialised instance. in 2.43.0
- security Implemented an SSRF protection mechanism with a configurable allow-list in settings (off / audit / enforce modes) in 2.43.0
- security Added an endpoint authorization check to /api/kubernetes/{id}/* routes, preventing users with no access from enumerating Kubernetes resources in 2.43.0
- security Fixed custom-template user-access checks that bypassed the Resource Control definition, allowing edit/inspect/delete authorization to ignore admins-only / public / team grants in 2.43.0
- security Filter GET namespace results by the user's allowed-namespace list, returning Forbidden for namespaces the user cannot access in 2.43.0
- security Bumped golang.org/x/net to v0.55.0 for the following CVEs: in 2.43.0
- security CVE-2026-39821, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-42502, CVE-2026-42506 in 2.43.0
- security Bumped golang.org/x/crypto to v0.52.0 for the following CVEs: in 2.43.0
- security CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-42508, CVE-2026-46595 in 2.43.0
- security Bumped go.opentelemetry.io/otel to v1.43.0 for the following CVEs: in 2.43.0
- security CVE-2026-39882, CVE-2026-39883 in 2.43.0
- security Bumped github.com/go-git/go-git/v5 to v5.19.1 for the following CVEs: in 2.43.0
- security CVE-2026-45571, GHSA-w5pp-99ch-qj29, CVE-2026-45570 in 2.43.0
- security Bumped Go stdlib to 1.26.4 for the following CVEs: in 2.43.0
- security CVE-2026-42504, CVE-2026-27145, CVE-2026-42507 in 2.43.0
- security Bumped Go to 1.26.3 for the following CVEs: in 2.43.0
- security CVE-2026-42499, CVE-2026-39836, CVE-2026-39820, CVE-2026-33814, CVE-2026-33811, CVE-2026-39826, CVE-2026-39823, CVE-2026-39825 in 2.43.0
- security Bumped containerd to 1.7.32 and containerd/v2 to 2.2.4 for the following CVEs: in 2.43.0
- security CVE-2026-46680 in 2.43.0
- security Upgraded the kubectl-shell Helm SDK to helm/v4 4.1.4 for the following CVEs: in 2.43.0
- security CVE-2026-35204, CVE-2026-35205 in 2.43.0
Deprecations
- deprecated None in 2.45.2
- deprecated None in 2.45.1
Every release in between
otherOn Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot
otherPodman environments aren't supported by auto-onboarding script
featureIt's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
featureSupport for only CentOS 9, Podman 5 rootful
securityPortainer no longer trusts TLS certificates issued by eMudhra (emSign), following the compromise of eight eMudhra intermediate CAs (CVE-2026-111943). Connections to services that present an affected certificate, including OAuth/OIDC and LDAPS providers, registries and Git hosts, will fail after…
securityRejected Compose and Swarm stacks using volumes_from when non-administrators create, update, start or redeploy them with Hide bind mounts for non-administrators enabled, which let them inherit another container's host bind mounts
securityUpdated the Go toolchain to 1.26.10, fixing CVE-2026-56857 and CVE-2026-78663 (both Critical), along with CVE-2026-111943, CVE-2026-97032, CVE-2026-97031, CVE-2026-94440, CVE-2026-94439, CVE-2026-78669, CVE-2026-78667, CVE-2026-78660, CVE-2026-78659, CVE-2026-56866, CVE-2026-94448 and CVE-2026-97030
securityRemoved the eMudhra emSign root certificates from the CA bundle in Linux images, and rejected certificate chains that contain the compromised eMudhra intermediates (CVE-2026-111943). See this FAQ for details.
securityUpdated golang.org/x/net to 0.60.0, fixing CVE-2026-78663 (Critical), CVE-2026-97032, CVE-2026-78669, CVE-2026-78660 and CVE-2026-78659 (all High)
securityUpdated helm in the kubectl shell image to v4.3.1, taking its Go toolchain to 1.27.2 and oras.land/oras-go/v2 to 2.6.2, fixing CVE-2026-39821 (Critical) and CVE-2026-50163 (High)
securityRestricted kubeconfig tokens to the /api/endpoints/{id}/kubernetes proxy, so they are rejected with a 403 on every other API route, including admin-only routes and the Docker proxy. Kubeconfigs downloaded after upgrading carry a separate token per environment, limited to that environment
fixFixed starting a container with an empty request body failing with a 400 error on Docker standalone and Swarm agent environments
fixFixed GitOps sources starting a new poll while the previous one was still running, which could pile up overlapping redeploys on slow repositories. A poll that is still running now causes the next scheduled poll to be skipped
fixFixed GitOps workflows showing the Git reference and file path status as unknown after a stack was manually redeployed from Git. A manual redeploy now records these statuses for the stack's workflow artifact
fixFixed the YAML tab on the Kubernetes node details page going blank after switching tabs or refocusing the browser, and restored the missing gap between the tab content and the Applications table
fixFixed DockerHub pull rate limits and agent version detection failing on Docker engines newer than API 1.47, and, in BE, non-admin users with environment access getting 403 errors on /agent/docker and /agent/host routes, which left Swarm node selectors empty
fixFixed the search box on the Authentication logs page not filtering events by username
otherOn Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot
otherPodman environments aren't supported by auto-onboarding script
featureIt's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
featureSupport for only CentOS 9, Podman 5 rootful
securityFixed a bypass of the "Hide bind mounts for non-administrators" setting. When it is enabled, Compose files deployed by non-administrators can no longer reference host files outside the stack directory (for example in configs, secrets or env_file), and include is disabled for them.
securityFixed a denied, failed or dry-run Kubernetes namespace deletion still removing Portainer's namespace access policies, stack records and registry bindings. These records are now removed only after Kubernetes accepts the deletion
securityFixed in-cluster HTTPS connections to the Kubernetes API server skipping TLS certificate verification during stack deploy and removal, on both the server and the agent
featureAdded a Node group column to the Kubernetes cluster node list for clusters using EKS, GKE, AKS, Karpenter or kops node pools, plus optional Instance type, Labels and Taints columns that can be turned on from the column menu
fixFixed the GitOps Sources page failing to load with "Object not found inside the database (bucket=workflows)" when a stack referenced a deleted workflow. Orphaned references are now skipped, and deleting a stack now unlinks it from its workflow in the same save
fixFixed deleting a Kubernetes stack with a namespace leaving behind objects whose manifest names no namespace
fixFixed Kubernetes Edge agents retrying removal of workload-less Edge stacks forever, which delayed new deployments and check-ins
fixFix the issue where the Docker dashboard volume count excludes volumes that restricted users have access to
fixFix the issue where the Async Edge dashboard includes container statistics for resources that Standard users cannot access
fixFix the issue where Compose stack undeploy operations do not respect the overall deployment timeout or cancellation context
fixFixed the default Unassigned environment group being renameable. It is now read-only, and a group that was already renamed can be reset to "Unassigned"
deprecatedNone
otherOn Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot
otherPodman environments aren't supported by auto-onboarding script
featureIt's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
featureSupport for only CentOS 9, Podman 5 rootful
securityHardened outbound requests against SSRF. Helm chart resolution and Git HTTP/HTTPS operations now go through the SSRF-aware transport, and the static rules that enforce this now match by type rather than by import alias, so an aliased import can no longer slip past them
otherCertificate-based authentication for Azure Blob backups is now disabled in FIPS mode
featureAdded build-time static analysis that catches FIPS violations before they ship
breakingRemoved unused non-FIPS code paths from FIPS builds
securityUpdated golang.org/x/mod to 0.40.0, fixing CVE-2026-56865 and CVE-2026-56864
securityUpdated golang.org/x/crypto to 0.56.0, fixing CVE-2026-56854 (High), CVE-2026-78662 and CVE-2026-56855
securityUpdated google.golang.org/grpc to 1.83.2, fixing CVE-2026-84304
securityUpdated kubectl in the kubectl shell image to v1.37.0, which removes golang.org/x/net 0.49.0 entirely — fixing CVE-2026-39821 (Critical) along with 2 High and 5 Medium findings
securityUpdated helm in the kubectl shell image to v4.2.4, taking golang.org/x/net to 0.56.0 and fixing CVE-2026-46600 (High)
securityUpgraded the Alpine packages in the kubectl shell image, taking openssl/libssl3 to 3.5.8-r0, libcurl to 8.22.0-r0 and jq to 1.8.2-r0. Clears 2 Critical findings (CVE-2026-63073 and CVE-2026-75803) plus 9 High, 11 Medium and 1 Low
otherSimplified the stat cards on the environment list
otherRenamed the GitOps “Edit git settings” button to “Edit stack settings”, which reflects what it actually changes
otherThe --secret-key-name help text now documents the BE secret path as well as the CE one
fixFixed the Swarm network list failing to render, showing “Cannot read properties of undefined (reading 'NodeRole')” and staying empty even after a network was created
fixFixed the node details Applications section listing pods that are not running on that node
fixFixed a registry personal access token continuing to be used after it was changed. The Helm registry cache is now flushed when credentials change
fixFixed the Edge Updater status page failing to load because of a broken status sort
featureAdded an info box to Edge stacks explaining that the GitOps source polling interval does not apply to them
deprecatedNone
featureIt's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
featureSupport for only CentOS 9, Podman 5 rootful
featureAdded advanced Kubernetes node drain options with agent failover
featureAdded native Portainer APIs for writing Kubernetes secrets, configmaps, deployments and persistent volume claims, replacing direct kube-apiserver proxy calls
featureAdded a generic Kubernetes manifest dry-run API
featureEdge Compute settings can now be configured during initial setup and via cli flags
featureAuthentication events now record the real client IP from X-Forwarded-For when the request comes through a trusted proxy
featureThe namespace YAML tab now shows every resource quota in the namespace
featureAdded GetCharts() support to the async Edge agent, so chart data syncs on agent startup
featureEdge agent connectivity checks now report progress while probing, and wait longer before failing
featureCreating a git source now skips the source type selection step
featureThe source form now explains git polling versus webhook triggers, and exposes the polling interval setting that was missing from the UI
featureRemoved the redundant single-tab handle from the workflow details view
featureReworded the registry creation tooltip to make the default behaviour obvious
featureClarified that Portainer supports Podman through its Docker-compatible API only
securityFixed a critical Docker proxy authorization bypass. Unrecognised API version prefixes like /v1.47.0/ or /v01.47/ skipped access control entirely, letting non-admin users reach the Docker API directly
securityClosed a remaining gap in the CVE-2026-44849 (GHSA-5fxq-qcf3-244w) fix and broadened bind-mount restrictions for non-admin users, now including Compose and Swarm stack deployments
securitySingle-namespace Kubernetes endpoints now check the caller’s namespace authorization instead of running as admin
securityRead-only and Helpdesk users can no longer view Kubernetes secret data
securityStandard users can no longer manage registry access
securityKubernetes authorization denials now return HTTP 403 instead of 500
securityFixed a Kubernetes shell authorization flaw. Caller-supplied query parameters could override the server's pod target, letting a standard user run commands in any pod on Agent-managed Kubernetes environments
securityUpdated the Go toolchain to 1.26.6, fixing CVE-2026-39821 (Critical, 9.6), an IDNA validation bypass of hostname-based access controls, along with CVE-2026-42505, CVE-2026-39822, CVE-2026-56862, CVE-2026-56860, CVE-2026-56859, CVE-2026-56858, CVE-2026-56853, CVE-2026-46600 and CVE-2026-33818
securityUpdated oras.land/oras-go/v2 to 2.6.2, fixing CVE-2026-50163
securityUpdated github.com/go-git/go-git/v5 to 5.19.2, fixing CVE-2026-71556 and CVE-2026-71557
securityUpdated go.opentelemetry.io/otel to 1.44.0, fixing CVE-2026-41178
securityUpdated github.com/klauspost/compress to 1.18.7, fixing GHSA-259r-337f-4rfw
securityUpgraded libcurl to 8.21.0-r0 in the kubectl-shell image to address the following CVEs: CVE-2026-11856, CVE-2026-10536, CVE-2026-11564, CVE-2026-12064, CVE-2026-11586, CVE-2026-11352, CVE-2026-9547, CVE-2026-9546, CVE-2026-9545, CVE-2026-9080, CVE-2026-9079, CVE-2026-8932, CVE-2026-8927,…
securityUpgraded c-ares to 1.34.8-r0 in the kubectl-shell image to address CVE-2026-33630
fixRemoving a stack now uninstalls the underlying Helm release, which used to be left running
fixFixed Edge stack workloads staying up after deletion on Kubernetes. The entry file and namespace are now sent on removal
fixFixed collisions during Edge stack removal and reassignment. The old stack is now removed before the new one deploys
fixFixed Lstat /data/edge_stacks//v1: no such file or directory on Kubernetes async agents by persisting the artifact commit hash before creating the Edge stack
fixFixed Azure Blob backup settings not saving, by resolving redacted credentials on write
fixFixed manual team-membership sync diverging from login-time sync by sharing a single implementation
fixFixed server-managed API key metadata fields being wiped on policy update
fixFixed spaces in setup policy names causing Kubernetes label errors
fixFixed the Policies card on the Kubernetes dashboard not counting all applied policy types
fixPolicy operations now return a meaningful error when the policy isn’t found, instead of a bare 404
securityDu Feilong () and Jerry () - added Docker --security-opt support and Swarm cluster self-heal after manager reap
+17 more items in the release notesfeatureIt's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
featureSupport for only CentOS 9, Podman 5 rootful
featureAdded a basic workflow details screen
featureAdded GPU visibility in the Environment Details view
featureMade the Portainer setup token easier to spot in the installation logs
featureTracked the Source, Workflow, and Artifact status persistently
featureUpgraded bbolt to v1.5.0 for performance and robustness improvements
featureMoved the build pipeline to BuildKit v0.31.2 (previously v0.27.0); image build provenance attestations moved to the SLSA v1.0 format (previously v0.2) — any tooling that parses attestations needed to be verified against the new format
securityFixed unauthorized access via leftover service accounts
securityFixed path traversal in the swarm compose deployer, where configs/secrets file paths escaped the project root
securityCVE remediation:
securityUpgraded oras.land/oras-go/v2 to 2.6.1 to remediate CVEs
securityUpgraded containerd to 1.7.33 / v2 2.2.5 to remediate CVEs
securityUpgraded google.golang.org/grpc to 1.82.1 to remediate GHSA-hrxh-6v49-42gf
securityUpgraded axios to 1.18.0 to remediate CVEs
securityUpgraded shell-quote to 1.8.4 to remediate CVEs
fixFixed the "This node is not a swarm manager" error message when running inside a swarm
fixFixed image builds failing to authenticate against private registries in FROM lines by allowing the X-Registry-Config header through the proxy
fixFixed a team with valid access not appearing in Config access control while another team with identical access was visible
fixFixed AD/LDAP settings defects where special characters were stripped, the username format selection was invisible, the root domain was unpopulated, and the delete button was broken
fixFixed an issue where [object Object] appeared as an element name on the Alerting page
fixFixed a problem that caused sources to fail to load
fixBrought back shared Git credentials for GitOps Sources
fixFixed an issue where a space-delimited list of scopes wasn't correctly requesting access to resources on the user's behalf, so the Google consent screen didn't show the expected permissions
fixFixed the poll frequency selection dropdown staying on the default value
fixFixed RBAC policy's datatable namespace input
fixFixed the forced polling usage in Git sources
fixFixed Helm chart uninstall showing cosmetic errors only
fixFixed the tooltip rendering for environment variables in Portainer Application Templates
fixFixed the Ingress service port number being displayed as 0 instead of the configured value
fixFixed Kubernetes manifest deployments reporting success but silently failing when "Use namespace from manifest" was disabled
fixFixed an output mismatch in the Kubectl shell between BE and CE
fixFixed an issue where logout caused an infinite page reload
fixFixed a missing source in the list until refresh
fixFixed non-admin redeploy failing when numeric environment variables were quoted in a stack (invalid containerPort)
fixFixed Portainer STS 2.42.0 showing "1 Agent needs upgrading" when none did
fixFixed Docker stack deployments that exceeded the 15-minute timeout remaining stuck in the "Deploying" state and blocking further redeployments
fixFixed RBAC policies not creating RoleBindings for grants with no namespace list (e.g. Operator, Helpdesk)
fixFixed re-assigning an edge group to an edge stack bringing back old state
fixFixed a regression where relative env_file: in Git sub-directory stacks resolved from the project root instead of the compose file's directory
+14 more items in the release notessecurityFixes CVE-2026-55761: Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. In versions 2.39.0 t…
featureIt's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
featureSupport for only CentOS 9, Podman 5 rootful
featureGitOps Sources: new Source Creation wizard, Source Detail screen and Source editing, with reuse of existing sources when adding Docker repository stacks and Kubernetes Helm-from-git installs
featureDisplay cached container images per node on Kubernetes
featureIn-product installation flow for KubeSolo-based single-node edge deployments
featureKubernetes application list and pod logs now default to expanded
featureEnvironment Group Detail View updated with a new sortable-list-based group list UI
securityAdded a one-time setup token, printed to the server logs at startup, that is required to create the first administrator account or restore a backup on a new, uninitialised instance.
securityImplemented an SSRF protection mechanism with a configurable allow-list in settings (off / audit / enforce modes)
securityAdded an endpoint authorization check to /api/kubernetes/{id}/* routes, preventing users with no access from enumerating Kubernetes resources
securityFixed custom-template user-access checks that bypassed the Resource Control definition, allowing edit/inspect/delete authorization to ignore admins-only / public / team grants
securityFilter GET namespace results by the user's allowed-namespace list, returning Forbidden for namespaces the user cannot access
securityBumped golang.org/x/net to v0.55.0 for the following CVEs:
securityCVE-2026-39821, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-42502, CVE-2026-42506
securityBumped golang.org/x/crypto to v0.52.0 for the following CVEs:
securityCVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-42508, CVE-2026-46595
securityBumped go.opentelemetry.io/otel to v1.43.0 for the following CVEs:
securityCVE-2026-39882, CVE-2026-39883
securityBumped github.com/go-git/go-git/v5 to v5.19.1 for the following CVEs:
securityCVE-2026-45571, GHSA-w5pp-99ch-qj29, CVE-2026-45570
securityBumped Go stdlib to 1.26.4 for the following CVEs:
securityCVE-2026-42504, CVE-2026-27145, CVE-2026-42507
securityBumped Go to 1.26.3 for the following CVEs:
securityCVE-2026-42499, CVE-2026-39836, CVE-2026-39820, CVE-2026-33814, CVE-2026-33811, CVE-2026-39826, CVE-2026-39823, CVE-2026-39825
securityBumped containerd to 1.7.32 and containerd/v2 to 2.2.4 for the following CVEs:
securityCVE-2026-46680
securityUpgraded the kubectl-shell Helm SDK to helm/v4 4.1.4 for the following CVEs:
securityCVE-2026-35204, CVE-2026-35205
fixFixed edge stacks that could not be deployed (Helm file-path cleared incorrectly)
fixFixed a ZodError (edgeStackId invalid input) when deploying an edge stack from a private repo to a group
fixFixed "Invalid option: expected one of 1|2" error for environments in the waiting room
fixFixed edge agent poll-handler timeouts and deadlocks; stale tunnels are now cleaned up immediately
fixFixed webhook POST returning 404 "Unable to find a webhook with this token" (webhook ID creation in the frontend)
fixFixed Git auto-update polling failures for regular stacks caused by a cancelled deployment context
fixStandard users with access permission can again browse and delete private registry images (2.39.2 regression)
fixFixed a 500 error on stack deploy/update when an invalid ECR registry is present; ECR token pre-validation errors now log a warning instead
fixNetworks assigned to a Docker Swarm service at creation time are now correctly applied to the created service
fixRestored YAML syntax highlighting in the web editor
fixImproved performance of the image up-to-date status indicator; the UI no longer becomes slow/unresponsive on environments with many containers
+18 more items in the release notes