Portainer vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-72533 An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via High 8.8 · Aug 11, 2026
• CVE-2026-55761 Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and AHigh 7.1 · Jul 8, 2026
• CVE-2026-44883 Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and AHigh 7.7 · May 28, 2026
• CVE-2026-44882 Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and AHigh 8.1 · May 28, 2026
• CVE-2026-44881 Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and AHigh 8.5 · May 28, 2026
• CVE-2026-44850 Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and AHigh 8.5 · May 28, 2026
• CVE-2026-44849 Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACritical 9.4 · May 28, 2026
• CVE-2026-44848 Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACritical 9.4 · May 28, 2026
• CVE-2026-33590 Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code execution.High 8.5 · May 28, 2026
• CVE-2024-33662 Portainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function.High 7.5 · Oct 2, 2024
• CVE-2024-33661 Portainer before 2.20.0 allows redirects when the target is not index.yaml.Critical 9.1 · Apr 25, 2024
• CVE-2022-24961 In Portainer Agent before 2.11.1, an API server can continue running even if not associated with a Portainer instance in the past few days.Critical 9.8 · Feb 11, 2022
• CVE-2020-24264 Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to remote arbitrary code execution.Critical 9.8 · Mar 16, 2021
• CVE-2020-24263 Portainer 1.24.1 and earlier is affected by an insecure permissions vulnerability that may lead to remote arbitrary code execution.High 8.8 · Mar 16, 2021
• CVE-2019-16877 Portainer before 1.22.1 has Incorrect Access Control (issue 4 of 4).High 8.8 · Nov 7, 2019
• CVE-2019-16876 Portainer before 1.22.1 allows Directory Traversal.High 7.5 · Nov 7, 2019
• CVE-2019-16872 Portainer before 1.22.1 has Incorrect Access Control (issue 1 of 4).Critical 9.9 · Nov 7, 2019
• CVE-2018-19466 A vulnerability was found in Portainer before 1.20.0.Critical 9.8 · Mar 27, 2019
• CVE-2018-19367 Portainer through 1.19.2 provides an API endpoint (/api/users/admin/check) to verify that the admin user is already created.Critical 9.8 · Nov 20, 2018
• CVE-2018-12678 Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with an unvalidated id query parameter for the /websocket/exec endpoint, whiCritical 9.8 · Jun 22, 2018