Is CVE-2026-33590 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33590 being exploited in the wild.

How severe is CVE-2026-33590?

Informational severity, with a CVSS score of 8.5, published 28 May 2026.

Is there a fix for CVE-2026-33590?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-33590 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-33590?

Check whether you run Portainer CE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33590: Portainer CE insecure default permissions allow host takeover

CVE-2026-33590 · Severity: info · CVSS 8.5 · Published 2026-05-28

Portainer CE, a popular tool for managing containerized applications, contained insecure default settings that granted excessive permissions to non-administrative users. An authenticated user could exploit these settings to access sensitive files on the host server or gain full administrative control (root access) over the underlying host. This could lead to a complete system takeover, data theft, or disruption of all services running on the affected server.

Technologies: Portainer CE. Vendors: Portainer.

Quick answers

Is CVE-2026-33590 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33590 being exploited in the wild.
How severe is CVE-2026-33590?: Informational severity, with a CVSS score of 8.5, published 28 May 2026.
Which products and versions are affected?: Portainer CE < 2.38.0.
Is there a fix for CVE-2026-33590?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-33590 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-33590?: Check whether you run Portainer CE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Portainer CE versions prior to 2.38.0 shipped with insecure default 'Endpoint Security' settings (CWE-276). Specifically, the default configuration enabled 'allowBindMountsForRegularUsers', 'allowPrivilegedModeForRegularUsers', and 'allowHostNamespaceForRegularUsers' for non-administrative accounts. An authenticated attacker with regular user access to an endpoint can exploit these settings to mount the host's root filesystem into a container or run containers in privileged mode to escape the container environment. This facilitates host-level file disclosure (e.g., reading /etc/shadow) and arbitrary code execution with root capabilities on the host system. The issue was addressed by changing these defaults to 'false' in Portainer CE 2.38.0 (STS) and 2.39.0 (LTS).

Affected products

Portainer Portainer CE < 2.38.0

Timeline

2025-11: other: Vulnerability discovered during research internship
2026-02-26: disclosed: Technical blog post published by researcher
2026-05-28: advisory: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.