Vulnerability · Published May 28, 2026 · Assigned by ENISA
CVE-2026-33590Insecure default permissions in Portainer CE
High 8.5
In plain English
A high-severity incorrect default permissions in Portainer Community Edition from Portainer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities).
Severity (CVSS 4.0)8.5High
Exploit odds (30 days)0.5%top 60.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code execution. An authenticated non-administrative user with endpoint access can exploit these settings to read host files or obtain root equivalent access on the host.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Portainer | Portainer Community Edition | 0 – before 2.39.00 – before 2.38.0 |
Weakness: CWE-276 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
References
- https://intwave.com/blog/2026/02/26/improving-portainer-security.html third-party-advisory
- https://github.com/portainer/portainer/commit/ac8fa7672e732b44b970c9eaf928eddd2c68796c issue-tracking
- https://github.com/portainer/portainer/commit/3e2fdb1891e81a8e4c5c8beb60e45f07c8ecae52 issue-tracking
- http://www.openwall.com/lists/oss-security/2026/06/12/2