PT-2026-41140 · Portainer+1 · Portainer Community Edition+1
CVSS v3.1
8.5
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Portainer Community Edition versions 2.33.0 through 2.33.7
Portainer Community Edition versions 2.39.0 through 2.39.1
Portainer Community Edition versions prior to 2.41.0
Description
Portainer includes a security setting to disable bind mounts for non-administrators, intended to prevent regular users from binding host paths into containers via the Portainer-mediated Docker API. However, the enforcement mechanism only inspected the
HostConfig.Binds array and ignored the equivalent HostConfig.Mounts array. Since both fields are interchangeable on the Docker daemon, an authenticated user with container-creation rights can bypass this restriction by submitting a bind-typed entry under HostConfig.Mounts at the 'POST /containers/create' endpoint. This allows the user to mount any host path into their container, potentially gaining read or write access to the host filesystem as the Docker daemon user (typically root). This can lead to the exposure of sensitive files, compromise of other containers on the same host, or full Docker API access if the Docker socket is mounted.Recommendations
Update Portainer Community Edition versions 2.33.0 through 2.33.7 to 2.33.8.
Update Portainer Community Edition versions 2.39.0 through 2.39.1 to 2.39.2.
Update Portainer Community Edition versions prior to 2.41.0 to 2.41.0.
Revoke container-create rights from non-administrator accounts on affected environments.
Segregate tenants by environment to provide stronger control than the bind-mount toggle.
Exploit
Fix
DoS
Missing Authorization
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Portainer Community Edition
Red Os