Is CVE-2026-44848 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44848 being exploited in the wild.

How severe is CVE-2026-44848?

High severity, with a CVSS score of 8.8, published 28 May 2026.

Which products and versions are affected?

github.com/portainer/portainer (Go) SEMVER:introduced=0, SEMVER:introduced=2.33.0,fixed=2.33.8; Portainer >= 2.33.0, = 2.39.0, = 2.40.0, = 2.33.0, = 2.39.0, = 2.40.0, < 2.41.0.

Is there a fix for CVE-2026-44848?

Yes. github.com/portainer/portainer (Go): upgrade to 2.33.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44848 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-44848?

Check whether you run github.com/portainer/portainer (Go), Portainer or Portainer Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44848: Portainer Community Edition missing authorization in Docker plugin endpoints

Q: Is there a fix for CVE-2026-44848?

Yes. github.com/portainer/portainer (Go): upgrade to 2.33.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44848 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-44848?

Check whether you run github.com/portainer/portainer (Go), Portainer or Portainer Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44848 · Severity: high · CVSS 8.8 · Published 2026-05-28

Portainer is a management tool used to simplify the deployment and monitoring of Docker containers. A security flaw allows non-administrator users with access to a Docker environment to bypass security checks and install malicious plugins. This can lead to a complete takeover of the underlying server, allowing attackers to access sensitive files and execute commands with root privileges.

Technologies: github.com/portainer/portainer (Go), Portainer, Portainer Community Edition. Vendors: Go, Portainer.

Quick answers

Is CVE-2026-44848 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44848 being exploited in the wild.
How severe is CVE-2026-44848?: High severity, with a CVSS score of 8.8, published 28 May 2026.
Which products and versions are affected?: github.com/portainer/portainer (Go) SEMVER:introduced=0, SEMVER:introduced=2.33.0,fixed=2.33.8; Portainer >= 2.33.0, < 2.33.8; >= 2.39.0, < 2.39.2; >= 2.40.0, < 2.41.0; Portainer Community Edition >= 2.33.0, < 2.33.8; >= 2.39.0, < 2.39.2; >= 2.40.0, < 2.41.0.
Is there a fix for CVE-2026-44848?: Yes. github.com/portainer/portainer (Go): upgrade to 2.33.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44848 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44848?: Check whether you run github.com/portainer/portainer (Go), Portainer or Portainer Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/portainer/portainer (Go): upgrade to 2.33.8 or later
```
go get github.com/portainer/portainer@v2.33.8
```

Technical details

A missing authorization vulnerability exists in Portainer's Docker API proxy layer. The proxy uses a prefix-based allowlist to route requests to handlers that enforce Role-Based Access Control (RBAC); however, the '/plugins' prefix was omitted from this map. Consequently, requests to plugin management endpoints fall through to a default execution function that forwards them to the Docker daemon without any authorization checks. An authenticated user with standard access to a Docker endpoint can pull, install, and enable arbitrary Docker plugins. Because Docker plugins can be configured with 'CAP_SYS_ADMIN' privileges and host-path mounts, an attacker can achieve full remote code execution and filesystem access as root on the host machine.

Affected products

Portainer Portainer >= 2.33.0, < 2.33.8; >= 2.39.0, < 2.39.2; >= 2.40.0, < 2.41.0

Identifiers

CVE-2026-44848
GHSA-rrmm-9v76-h3p4
GO-2026-5639

Timeline

2026-03-16: disclosed: Reported by Henrique Pereira (ikkebr) via GitHub Security Advisory
2026-04-20: patched: Fix merged to development and release branches
2026-04-29: advisory: Version 2.41.0 released
2026-05-07: advisory: Versions 2.39.2-LTS and 2.33.8-LTS released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.