DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-55761: CVE-2026-55761: Improper Authentication Vulnerability in Portainer Community Edition

#security #cve #cybersecurity

CVE-2026-55761: Improper Authentication Vulnerability in Portainer Community Edition

Vulnerability ID: CVE-2026-55761
CVSS Score: 7.1
Published: 2026-08-28

An improper authentication vulnerability (CWE-287) in Portainer Community Edition (CE) allows unauthenticated remote attackers to achieve full administrative takeover. During the initial five-minute uninitialized setup window, sensitive endpoints responsible for creating the initial administrator user and restoring database state are publicly accessible without authentication. Attackers can exploit this to create administrative credentials or overwrite the system state with a malicious database configuration.

TL;DR

Uninitialized Portainer CE instances expose administrative configuration and restore endpoints without authentication during the initial five-minute setup window. Remote attackers can exploit this to register admin accounts or restore malicious configurations, leading to complete instance compromise.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-287
  • Attack Vector: Network
  • CVSS Score: 7.1
  • EPSS Score: 0.00493
  • EPSS Percentile: 40.19%
  • Impact: Full Administrative Takeover
  • Exploit Status: Proof-of-Concept
  • KEV Status: Not listed

Affected Systems

  • Portainer Community Edition
  • Portainer Community Edition: >= 2.39.0, < 2.39.4 (Fixed in: 2.39.4)
  • Portainer Community Edition: >= 2.40.0, < 2.43.0 (Fixed in: 2.43.0)

Code Analysis

Commit: d2b56ef

Initial implementation of the cryptographic setup token module to secure uninitialized administrative and restore endpoints.

Commit: 49f1910

Refactoring and configuration additions for setup tokens, establishing environment variables and command line flags.

Mitigation Strategies

  • Upgrade to Portainer CE version 2.39.4, 2.43.0, or higher.
  • Enforce network segmentation and bind setup interfaces to local loopback addresses during initialization.
  • Explicitly configure a secure custom setup token via startup parameters.

Remediation Steps:

  1. Identify all uninitialized Portainer installations inside the network.
  2. Upgrade the container image tags to 2.39.4 or 2.43.0 in orchestration manifests.
  3. Configure the PORTAINER_SETUP_TOKEN environment variable with a strong cryptographic secret.
  4. Review container stdout logs post-startup to verify that the setup token requirement is successfully enforced.

References

Read the full report for CVE-2026-55761 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)