CVE-2026-33590— Insecure default permissions in Portainer CE
Affected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Portainer | Portainer Community Edition | < 2.39.0 | affected |
< 2.38.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-33590
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Insecure default permissions in Portainer CE
Source: NVD (National Vulnerability Database)
Vulnerability Description
Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code execution. An authenticated non-administrative user with endpoint access can exploit these settings to read host files or obtain root equivalent access on the host.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
缺省权限不正确
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Portainer | Portainer Community Edition | 0 ~ 2.39.0 | - |
II. Public POCs for CVE-2026-33590
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-33590
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-33590 (2)
Security Blog Posts for CVE-2026-33590 (1)
Same Patch Batch · Portainer · 2026-05-28 · 9 CVEs total
| CVE-2026-44850 | 8.5 HIGH | Portainer: Bind-mount restriction bypass via HostConfig.Mounts |
| CVE-2026-44882 | 8.1 HIGH | Portainer: Kubernetes middleware continues after token validation failure, bypassing endpo |
| CVE-2026-44885 | 5.5 MEDIUM | Portainer: Path traversal in backup archive extraction allows arbitrary file write |
| CVE-2026-44881 | Portainer: Arbitrary File Read via Git Symlink Injection in Stack Auto-Update | |
| CVE-2026-44884 | Portainer: Missing authorization on custom template file endpoint exposes template content | |
| CVE-2026-44848 | Portainer: Missing authorization on Docker plugin endpoints allows host RCE | |
| CVE-2026-44883 | Portainer: JWT accepted in URL query leaks tokens to logs and referers | |
| CVE-2026-44849 | Portainer: Endpoint security bypass via Swarm service create/update |
IV. Related Vulnerabilities
Same vendor: Portainer
- CVE-2026-44881
Portainer: Arbitrary File Read via Git Symlink Injection in - CVE-2026-44848
Portainer: Missing authorization on Docker plugin endpoints - CVE-2026-44849
Portainer: Endpoint security bypass via Swarm service create - CVE-2026-44850
Portainer: Bind-mount restriction bypass via HostConfig.Moun - CVE-2026-44882
Portainer: Kubernetes middleware continues after token valid
Same weakness: CWE-276
- CVE-2026-49237
Local Privilege Escalation in Canonical Multipass - CVE-2026-44469
Incorrect Default Permissions in CODESYS Development System - CVE-2026-44468
Incorrect Default Permissions in CODESYS Development System - CVE-2018-25359
Splinterware System Scheduler Pro 5.12 Privilege Escalation - CVE-2025-32749
Dell PowerFlex Manager 安全漏洞
V. Comments for CVE-2026-33590
No comments yet