Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code execution. An authenticated non-administrative user with endpoint access can exploit these settings to read host files or obtain root equivalent access on the host.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-16 | 1 | Patch1 |
| 2026-06-18 | 1 | Disclosure1 |
CVE-2026-33590: Portainer: Insecure default settings allow host takeover https://www.openwall.com/lists/oss-security/2026/06/12/2 Fixed in 2.38.0, 2.39.0. Software for the management of containers.
Post summary
A newly disclosed Portainer vulnerability (CVE-2026-33590) stemming from insecure default settings allows host takeover; the issue has been fixed in versions 2.38.0 and 2.39.0.
If you run Portainer for a team, every non-admin user you onboarded before 2.38.0 could own the host. CVE-2026-33590 turns "give a teammate container access" into "give a teammate root." Patch to 2.38.0 STS or 2.39.0 LTS now. How many people had non-admin access on your instance?
Post summary
CVE‑2026‑33590 allows non‑admin Portainer users to gain host ownership; patching to 2.38.0 STS or 2.39.0 LTS mitigates the flaw.