CVE-2018-12678: Portainer

Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days.

Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with an unvalidated id query parameter for the /websocket/exec endpoint, which allows remote attackers to bypass intended access restrictions or conduct SSRF attacks.

Affected products

• Portainer Portainer: before 1.18.0 (fixed in 1.18.0)

Published 2018-06-22. Last modified 2026-06-17.