CVE-2026-55761

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. In versions 2.39.0 through 2.39.3 and 2.40.0 until 2.43.0, unauthenticated restore and administrator initialization endpoints (/api/restore and /api/users/admin/init) remain accessible during the five-minute setup window for uninitialized instances, allowing a network attacker to restore a crafted backup or create the first administrator account and gain full administrative access. This issue is fixed in versions 2.39.4 and 2.43.0.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/portainer/portainer/commit/49f19107cf9a3540cbe406c9eb7f24390e1af02b	Patch
https://github.com/portainer/portainer/commit/d2b56efcb4e43c4168bb6688eee9f6bf22867312	Patch
https://github.com/portainer/portainer/issues/2770	Issue Tracking
https://github.com/portainer/portainer/releases/tag/2.39.4	Release Notes
https://github.com/portainer/portainer/releases/tag/2.43.0	Release Notes
https://github.com/portainer/portainer/security/advisories/GHSA-x626-fcwx-f5pc	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:portainer:portainer:::::community:::*
	cpe:2.3:a:portainer:portainer:::::community:::*

History

No history.

Information

Published : 2026-07-08 16:16

Updated : 2026-07-10 17:48

NVD link : CVE-2026-55761

Mitre link : CVE-2026-55761

CVE.ORG link : CVE-2026-55761

JSON object : View

Products Affected

portainer

portainer

CWE

CWE-287

Improper Authentication

NVD-CWE-noinfo

{"id": "CVE-2026-55761", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55761", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-08T15:51:27.827566Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "portainer", "product": "portainer", "versions": [{"status": "affected", "version": ">= 2.39.0, < 2.39.4"}]}]}], "published": "2026-07-08T16:16:31.020", "references": [{"url": "https://github.com/portainer/portainer/commit/49f19107cf9a3540cbe406c9eb7f24390e1af02b", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/portainer/portainer/commit/d2b56efcb4e43c4168bb6688eee9f6bf22867312", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/portainer/portainer/issues/2770", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/portainer/portainer/releases/tag/2.39.4", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/portainer/portainer/releases/tag/2.43.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/portainer/portainer/security/advisories/GHSA-x626-fcwx-f5pc", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-287"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. In versions 2.39.0 through 2.39.3 and 2.40.0 until 2.43.0, unauthenticated restore and administrator initialization endpoints (/api/restore and /api/users/admin/init) remain accessible during the five-minute setup window for uninitialized instances, allowing a network attacker to restore a crafted backup or create the first administrator account and gain full administrative access. This issue is fixed in versions 2.39.4 and 2.43.0."}], "lastModified": "2026-07-10T17:48:26.790", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:portainer:portainer:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "60BA3C37-7C24-47CA-9CBF-B6E3A45583A4", "versionEndExcluding": "2.39.4", "versionStartIncluding": "2.39.0"}, {"criteria": "cpe:2.3:a:portainer:portainer:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "749C4535-79C1-4C3B-99C2-8FC556ED01A6", "versionEndExcluding": "2.43.0", "versionStartIncluding": "2.40.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}