EUVD-2026-56003
GHSA-588v-59vc-3xh9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Low-privileged network attacker gains root on the Docker host - a cross-component boundary crossing that warrants S:C over the provided S:U.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoint fails to normalize request paths before applying access controls, allowing crafted requests to be interpreted differently by the proxy and the authorization layer. Successful exploitation grants the attacker root-level access to the underlying Docker host.
Articles & Coverage 1
AnalysisAI
Portainer CE through 2.44.0 exposes root-level Docker host access to any authenticated low-privileged user via a URL path normalization flaw in the Docker proxy endpoint. The authorization middleware evaluates a non-canonical request path (e.g., percent-encoded slashes, double slashes, or traversal sequences) differently from the proxy layer that ultimately forwards it to the Docker daemon - allowing crafted requests to bypass all access controls while executing with full Docker API privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Portainer CE user account at any privilege level - the vulnerability is not accessible to unauthenticated actors. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 8.8 with AV:N/AC:L/PR:L/UI:N reflects a high-severity network-exploitable flaw requiring no interaction and low complexity - only a valid Portainer account is needed, which is a meaningful but modest barrier in environments with multiple users or shared access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a low-privileged Portainer account - obtained legitimately, via credential stuffing, or through phishing - sends a crafted HTTP request to the Portainer Docker proxy endpoint using a non-canonical URL path such as double-encoded slashes or percent-encoded separators. The authorization middleware evaluates the raw path, determines the request targets a non-privileged endpoint, and permits it; the Go HTTP proxy library canonicalizes the path before forwarding, and the Docker daemon receives and executes the intended privileged API call. … |
| Remediation | No vendor-released patched version has been independently confirmed at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Portainer CE deployments to identify and document systems running version 2.44.0 or earlier; immediately restrict Portainer administrative interfaces to trusted networks only using firewall rules. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 2
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today