CVE-2026-44884: Portainer

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8 and 2.39.1, a missing authorization vulnerability in the Custom Template file endpoint (GET /api/custom_templates/{id}/file) allows any authenticated user to read the file content of any custom template by enumerating sequential integer IDs, bypassing Resource Control access restrictions. Template files may contain environment-specific values such as connection strings, API tokens, or registry credentials that administrators would not expect standard users to read. This vulnerability is fixed in 2.33.8 and 2.39.1.

Affected products

• Portainer Portainer: from 2.33.0, before 2.33.8 (fixed in 2.33.8); from 2.39.0, before 2.39.1 (fixed in 2.39.1)

Published 2026-05-28. Last modified 2026-07-21.