PT-2026-41144 · Go+1 · Github.Com/Portainer/Portainer+1

Published 2026-05-14 · Updated 2026-05-28 · CVE-2026-44884

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Portainer Community Edition versions 2.33.0 through 2.33.7 Portainer Community Edition versions 2.39.0 through 2.39.0 Portainer Community Edition versions prior to 2.33.0

Description A missing authorization issue in the Custom Template file endpoint "GET /api/custom templates/{id}/file" allows any authenticated user to read the file content of any custom template. This is achieved by enumerating sequential integer IDs in the id variable, which bypasses Resource Control access restrictions. The customTemplateFile() function retrieves the template by its numeric ID and returns the content without performing an authorization check. Template files may contain sensitive environment-specific values, such as connection strings, API tokens, or registry credentials.

Recommendations Update to version 2.33.8. Update to version 2.39.1. Upgrade to a supported release. Avoid storing secrets in custom templates by moving sensitive configuration values to environment variables or an external secret store. Review existing custom templates for embedded secrets and rotate any credentials that may have been exposed.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-44884

GHSA-CQPQ-2FGR-8MVC

Affected Products

Github.Com/Portainer/Portainer

Portainer

References · 6

• https://osv.dev/vulnerability/GHSA-cqpq-2fgr-8mvc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44884 · Security Note
• https://github.com/portainer/portainer/releases/tag/2.39.2 · Note
• https://github.com/portainer/portainer · Note
• https://github.com/portainer/portainer/security/advisories/GHSA-cqpq-2fgr-8mvc · Note
• https://github.com/portainer/portainer/releases/tag/2.33.8 · Note