Which versions of Docker are affected by CVE-2026-55761?

Portainer Community Edition versions 2.39.0-2.42.x contain an authentication bypass affecting recently deployed instances, allowing unauthenticated attackers to assume administrative control during…. A patch is available.

Is there a public PoC exploit available for CVE-2026-55761?

Yes, a public proof-of-concept exploit is available for CVE-2026-55761. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-55761?

Within 24 hours: Inventory all Portainer Community Edition instances and identify affected versions (2.39.0-2.39.3, 2.40.0-2.42.x); restrict network access to /api/restore and /api/users/admin/init endpoints to trusted networks only. Within 7 days: Upgrade all affected instances to patched versions 2.39.4 or 2.43.0+. Within 30 days: Verify 100% patch deployment across all instances and implement network segmentation for administrative access.

Docker CVE-2026-55761

Q: What is the CVSS score of CVE-2026-55761?

CVE-2026-55761 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42297 HIGH

Improper Authentication (CWE-287)

2026-07-08 GitHub_M

GHSA-x626-fcwx-f5pc

Authentication Bypass Docker Kubernetes Suse Portainer

7.1

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 08, 2026 - 17:01 EUVD

Analysis Generated

Jul 08, 2026 - 16:17 vuln.today

CVE Published

Jul 08, 2026 - 15:03 cve.org

HIGH 7.1

DescriptionCVE.org

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. In versions 2.39.0 through 2.39.3 and 2.40.0 until 2.43.0, unauthenticated restore and administrator initialization endpoints (/api/restore and /api/users/admin/init) remain accessible during the five-minute setup window for uninitialized instances, allowing a network attacker to restore a crafted backup or create the first administrator account and gain full administrative access. This issue is fixed in versions 2.39.4 and 2.43.0.

Articles & Coverage 2

News 4 New Docker Vulnerabilities - 1 Critical, 3 High, 1 With POC Jul 09, 2026 News 3 New Kubernetes Vulnerabilities - 1 Critical, 2 High Severity Jul 08, 2026

AnalysisAI

Authentication bypass in Portainer Community Edition (2.39.0-2.39.3 and 2.40.0 through 2.42.x) lets an unauthenticated network attacker seize full administrative control of a freshly deployed, uninitialized instance. During the five-minute post-deployment setup window the /api/restore and /api/users/admin/init endpoints stay reachable without credentials, so an attacker who wins the race can create the first admin account or restore a crafted backup and take over the platform along with every Docker, Swarm, Kubernetes and ACI environment it manages. No public exploit identified at time of analysis and it is not on CISA KEV, but the fix is available in 2.39.4 and 2.43.0.