CVE-2026-44849

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44849", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-07T21:21:48.353Z", "datePublished": "2026-05-28T21:06:05.256Z", "dateUpdated": "2026-05-29T13:55:06.837Z"}, "containers": {"cna": {"title": "Portainer: Endpoint security bypass via Swarm service create/update", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "baseScore": 9.4, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0"}}], "references": [{"name": "https://github.com/portainer/portainer/security/advisories/GHSA-5fxq-qcf3-244w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/portainer/portainer/security/advisories/GHSA-5fxq-qcf3-244w"}], "affected": [{"vendor": "portainer", "product": "portainer", "versions": [{"version": ">= 2.33.0, < 2.33.8", "status": "affected"}, {"version": ">= 2.39.0, < 2.39.2", "status": "affected"}, {"version": ">= 2.40.0, < 2.41.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-28T21:06:05.256Z"}, "descriptions": [{"lang": "en", "value": "Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer enforces seven EndpointSecuritySettings restrictions that administrators configure to restrict the container configurations non-admin users can launch: privileged mode, host PID namespace, device mapping, capabilities, sysctls, security-opt (Seccomp / AppArmor), and bind mounts. These restrictions are enforced on the standard container creation path, but several of them are not applied on the Docker Swarm service API. This vulnerability is fixed in 2.33.8, 2.39.2, and 2.41.0."}], "source": {"advisory": "GHSA-5fxq-qcf3-244w", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-29T13:54:58.082787Z", "id": "CVE-2026-44849", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-29T13:55:06.837Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44849", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-29T13:54:58.082787Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-29T13:55:01.267Z"}}], "cna": {"title": "Portainer: Endpoint security bypass via Swarm service create/update", "source": {"advisory": "GHSA-5fxq-qcf3-244w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "portainer", "product": "portainer", "versions": [{"status": "affected", "version": ">= 2.33.0, < 2.33.8"}, {"status": "affected", "version": ">= 2.39.0, < 2.39.2"}, {"status": "affected", "version": ">= 2.40.0, < 2.41.0"}]}], "references": [{"url": "https://github.com/portainer/portainer/security/advisories/GHSA-5fxq-qcf3-244w", "name": "https://github.com/portainer/portainer/security/advisories/GHSA-5fxq-qcf3-244w", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer enforces seven EndpointSecuritySettings restrictions that administrators configure to restrict the container configurations non-admin users can launch: privileged mode, host PID namespace, device mapping, capabilities, sysctls, security-opt (Seccomp / AppArmor), and bind mounts. These restrictions are enforced on the standard container creation path, but several of them are not applied on the Docker Swarm service API. This vulnerability is fixed in 2.33.8, 2.39.2, and 2.41.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-28T21:06:05.256Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44849", "state": "PUBLISHED", "dateUpdated": "2026-05-29T13:55:06.837Z", "dateReserved": "2026-05-07T21:21:48.353Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-28T21:06:05.256Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "portainer", "vendor": "portainer", "versions": [{"status": "affected", "version": ">= 2.33.0, < 2.33.8"}, {"status": "affected", "version": ">= 2.39.0, < 2.39.2"}, {"status": "affected", "version": ">= 2.40.0, < 2.41.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:portainer:portainer:*:*:*:*:community:*:*:*", "matchCriteriaId": "4E7FE81D-D489-4034-9DB4-D48E3B6C3CE4", "versionEndExcluding": "2.33.8", "versionStartIncluding": "2.33.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:portainer:portainer:*:*:*:*:community:*:*:*", "matchCriteriaId": "3717D3CE-5226-41F7-A131-7CCAF164914D", "versionEndExcluding": "2.39.1", "versionStartIncluding": "2.34.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:portainer:portainer:2.40.0:*:*:*:community:*:*:*", "matchCriteriaId": "69F71AFC-F50D-4D10-9918-413D8E841CC2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer enforces seven EndpointSecuritySettings restrictions that administrators configure to restrict the container configurations non-admin users can launch: privileged mode, host PID namespace, device mapping, capabilities, sysctls, security-opt (Seccomp / AppArmor), and bind mounts. These restrictions are enforced on the standard container creation path, but several of them are not applied on the Docker Swarm service API. This vulnerability is fixed in 2.33.8, 2.39.2, and 2.41.0."}, {"lang": "es", "value": "Portainer Community Edition es una plataforma ligera de entrega de servicios para aplicaciones en contenedores que puede usarse para gestionar entornos Docker, Swarm, Kubernetes y ACI. Desde la 2.33.0 hasta antes de la 2.33.8, 2.39.2 y 2.41.0, Portainer aplica siete restricciones de EndpointSecuritySettings que los administradores configuran para restringir las configuraciones de contenedores que los usuarios no administradores pueden iniciar: modo privilegiado, espacio de nombres PID del host, mapeo de dispositivos, capacidades, sysctls, security-opt (Seccomp / AppArmor) y montajes de enlace. Estas restricciones se aplican en la ruta est\u00e1ndar de creaci\u00f3n de contenedores, pero varias de ellas no se aplican en la API del servicio Docker Swarm. Esta vulnerabilidad se corrige en la 2.33.8, 2.39.2 y 2.41.0."}], "id": "CVE-2026-44849", "lastModified": "2026-07-21T10:10:00.103", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44849", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-29T13:54:58.082787Z", "version": "2.0.3"}}]}, "published": "2026-05-28T22:16:58.973", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/portainer/portainer/security/advisories/GHSA-5fxq-qcf3-244w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.33.0,2.33.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.39.0,2.39.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.40.0,2.41.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "portainer", "source": "cna", "vendor": "portainer"}, "product": "portainer", "vendor": "portainer"}], "created": "2026-05-28T22:30:27.928025+00:00", "updated": "2026-05-28T23:00:16.928989+00:00", "vendors": ["portainer", "portainer$PRODUCT$portainer"]}