PT-2026-56482 · Portainer · Portainer

Publicado 2026-07-08 · Atualizado 2026-07-08 · CVE-2026-55761

Mitre

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. In versions 2.39.0 through 2.39.3 and 2.40.0 until 2.43.0, unauthenticated restore and administrator initialization endpoints (/api/restore and /api/users/admin/init) remain accessible during the five-minute setup window for uninitialized instances, allowing a network attacker to restore a crafted backup or create the first administrator account and gain full administrative access. This issue is fixed in versions 2.39.4 and 2.43.0.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2026-55761

Produtos afetados

Portainer

Referências · 7

• https://github.com/portainer/portainer/security/advisories/GHSA-x626-fcwx-f5pc · Nota
• https://github.com/portainer/portainer/commit/49f19107cf9a3540cbe406c9eb7f24390e1af02b · Nota
• https://github.com/portainer/portainer/commit/d2b56efcb4e43c4168bb6688eee9f6bf22867312 · Nota
• https://github.com/portainer/portainer/releases/tag/2.43.0 · Nota
• https://github.com/portainer/portainer/issues/2770 · Nota
• https://github.com/portainer/portainer/releases/tag/2.39.4 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-55761 · Nota de Segurança