CVE-2026-44884
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and …
Impact
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8 and 2.39.1, a missing authorization vulnerability in the Custom Template file endpoint (GET /api/custom_templates/{id}/file) allows any authenticated user to read the file content of any custom template by enumerating sequential integer IDs, bypassing Resource Control access restrictions. Template files may contain environment-specific values such as connection strings, API tokens, or registry credentials that administrators would not expect standard users to read. This vulnerability is fixed in 2.33.8 and 2.39.1.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/portainer/portainer | >= 2.33.0, < 2.33.8 | 2.33.8 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Portainer | Portainer | from 2.33.0 before 2.33.8 from 2.39.0 before 2.39.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-cqpq-2fgr-8mvc
- https://github.com/portainer/portainer/security/advisories/GHSA-cqpq-2fgr-8mvc
- https://github.com/portainer/portainer/releases/tag/2.33.8
- https://github.com/portainer/portainer/releases/tag/2.39.2
- https://nvd.nist.gov/vuln/detail/CVE-2026-44884