high8.5
CVE-2026-33590
Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code execution.
Impact
Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code execution. An authenticated non-administrative user with endpoint access can exploit these settings to read host files or obtain root equivalent access on the host.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/portainer/portainer/commit/3e2fdb1891e81a8e4c5c8beb60e45f07c8ecae52
- https://github.com/portainer/portainer/commit/ac8fa7672e732b44b970c9eaf928eddd2c68796c
- https://intwave.com/blog/2026/02/26/improving-portainer-security.html
- http://www.openwall.com/lists/oss-security/2026/06/12/2