CVE-2026-44882

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44882", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-07T21:50:33.544Z", "datePublished": "2026-05-28T21:01:31.113Z", "dateUpdated": "2026-05-30T02:20:47.586Z"}, "containers": {"cna": {"title": "Portainer: Kubernetes middleware continues after token validation failure, bypassing endpoint authorization", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/portainer/portainer/security/advisories/GHSA-mgq6-4x29-88r3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/portainer/portainer/security/advisories/GHSA-mgq6-4x29-88r3"}], "affected": [{"vendor": "portainer", "product": "portainer", "versions": [{"version": ">= 2.33.0, < 2.33.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-28T21:01:31.113Z"}, "descriptions": [{"lang": "en", "value": "Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33., Portainer proxies requests to Kubernetes clusters through a middleware layer (kubeClientMiddleware) that validates the requesting user's token before forwarding traffic to the cluster. When security.RetrieveTokenData returned an error, the middleware wrote an HTTP 403 response but was missing a return statement \u2014 execution continued into the handler with a nil tokenData value. The Kubernetes endpoints sit behind Portainer's outer AuthenticatedAccess bouncer, so an attacker requires a valid Portainer session. However, a user whose secondary token validation fails in kubeClientMiddleware \u2014 for example a user without permission to access a given Kubernetes endpoint \u2014 would have their request forwarded to the cluster anyway, bypassing the authorization check. The same defect was present in both the CE and EE codebases. This vulnerability is fixed in 2.33.8."}], "source": {"advisory": "GHSA-mgq6-4x29-88r3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-30T02:20:34.739258Z", "id": "CVE-2026-44882", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-30T02:20:47.586Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44882", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-30T02:20:34.739258Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-30T02:20:42.651Z"}}], "cna": {"title": "Portainer: Kubernetes middleware continues after token validation failure, bypassing endpoint authorization", "source": {"advisory": "GHSA-mgq6-4x29-88r3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "portainer", "product": "portainer", "versions": [{"status": "affected", "version": ">= 2.33.0, < 2.33.8"}]}], "references": [{"url": "https://github.com/portainer/portainer/security/advisories/GHSA-mgq6-4x29-88r3", "name": "https://github.com/portainer/portainer/security/advisories/GHSA-mgq6-4x29-88r3", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33., Portainer proxies requests to Kubernetes clusters through a middleware layer (kubeClientMiddleware) that validates the requesting user's token before forwarding traffic to the cluster. When security.RetrieveTokenData returned an error, the middleware wrote an HTTP 403 response but was missing a return statement \u2014 execution continued into the handler with a nil tokenData value. The Kubernetes endpoints sit behind Portainer's outer AuthenticatedAccess bouncer, so an attacker requires a valid Portainer session. However, a user whose secondary token validation fails in kubeClientMiddleware \u2014 for example a user without permission to access a given Kubernetes endpoint \u2014 would have their request forwarded to the cluster anyway, bypassing the authorization check. The same defect was present in both the CE and EE codebases. This vulnerability is fixed in 2.33.8."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-28T21:01:31.113Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44882", "state": "PUBLISHED", "dateUpdated": "2026-05-30T02:20:47.586Z", "dateReserved": "2026-05-07T21:50:33.544Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-28T21:01:31.113Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "portainer", "vendor": "portainer", "versions": [{"status": "affected", "version": ">= 2.33.0, < 2.33.8"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:portainer:portainer:*:*:*:*:community:*:*:*", "matchCriteriaId": "4E7FE81D-D489-4034-9DB4-D48E3B6C3CE4", "versionEndExcluding": "2.33.8", "versionStartIncluding": "2.33.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33., Portainer proxies requests to Kubernetes clusters through a middleware layer (kubeClientMiddleware) that validates the requesting user's token before forwarding traffic to the cluster. When security.RetrieveTokenData returned an error, the middleware wrote an HTTP 403 response but was missing a return statement \u2014 execution continued into the handler with a nil tokenData value. The Kubernetes endpoints sit behind Portainer's outer AuthenticatedAccess bouncer, so an attacker requires a valid Portainer session. However, a user whose secondary token validation fails in kubeClientMiddleware \u2014 for example a user without permission to access a given Kubernetes endpoint \u2014 would have their request forwarded to the cluster anyway, bypassing the authorization check. The same defect was present in both the CE and EE codebases. This vulnerability is fixed in 2.33.8."}, {"lang": "es", "value": "Portainer Community Edition es una plataforma ligera de entrega de servicios para aplicaciones en contenedores que puede utilizarse para gestionar entornos Docker, Swarm, Kubernetes y ACI. Desde la 2.33.0 hasta antes de la 2.33., Portainer act\u00faa como proxy para las solicitudes a los cl\u00fasteres de Kubernetes a trav\u00e9s de una capa de middleware (kubeClientMiddleware) que valida el token del usuario solicitante antes de reenviar el tr\u00e1fico al cl\u00faster. Cuando security.RetrieveTokenData devolv\u00eda un error, el middleware escrib\u00eda una respuesta HTTP 403 pero faltaba una sentencia de retorno \u2014 la ejecuci\u00f3n continuaba en el gestor con un valor tokenData nulo. Los puntos finales de Kubernetes se encuentran detr\u00e1s del bouncer externo AuthenticatedAccess de Portainer, por lo que un atacante requiere una sesi\u00f3n v\u00e1lida de Portainer. Sin embargo, un usuario cuya validaci\u00f3n de token secundaria falla en kubeClientMiddleware \u2014 por ejemplo, un usuario sin permiso para acceder a un punto final de Kubernetes determinado \u2014 ver\u00eda su solicitud reenviada al cl\u00faster de todos modos, omitiendo la comprobaci\u00f3n de autorizaci\u00f3n. El mismo defecto estaba presente tanto en las bases de c\u00f3digo CE como EE. Esta vulnerabilidad est\u00e1 corregida en la 2.33.8."}], "id": "CVE-2026-44882", "lastModified": "2026-07-21T10:10:00.103", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44882", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-30T02:20:34.739258Z", "version": "2.0.3"}}]}, "published": "2026-05-28T22:16:59.380", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/portainer/portainer/security/advisories/GHSA-mgq6-4x29-88r3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.33.0,2.33.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "portainer", "source": "cna", "vendor": "portainer"}, "product": "portainer", "vendor": "portainer"}], "created": "2026-05-28T22:30:27.928669+00:00", "updated": "2026-05-28T22:30:28.285422+00:00", "vendors": ["portainer", "portainer$PRODUCT$portainer"]}