# CVE-2026-44848: Portainer Community Edition missing authorization in Docker plugin endpoints

Source: https://junglewise.ai/threats/cve-2026-44848-portainer-community-edition-missing-authorization-in-docker  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-44848 · Severity: high · CVSS 8.8 · Published 2026-05-28

Portainer is a management tool used to simplify the deployment and monitoring of Docker containers. A security flaw allows non-administrator users with access to a Docker environment to bypass security checks and install malicious plugins. This can lead to a complete takeover of the underlying server, allowing attackers to access sensitive files and execute commands with root privileges.

Technologies: [github.com/portainer/portainer (Go)](https://junglewise.ai/threats/technologies/github-com-portainer-portainer), [Portainer](https://junglewise.ai/threats/technologies/portainer), [Portainer Community Edition](https://junglewise.ai/threats/technologies/portainer-community-edition). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Portainer](https://junglewise.ai/threats/vendors/portainer).

## Quick answers

**Is CVE-2026-44848 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44848 being exploited in the wild.

**How severe is CVE-2026-44848?** High severity, with a CVSS score of 8.8, published 28 May 2026.

**Which products and versions are affected?** github.com/portainer/portainer (Go) SEMVER:introduced=0, SEMVER:introduced=2.33.0,fixed=2.33.8; Portainer >= 2.33.0, < 2.33.8; >= 2.39.0, < 2.39.2; >= 2.40.0, < 2.41.0; Portainer Community Edition >= 2.33.0, < 2.33.8; >= 2.39.0, < 2.39.2; >= 2.40.0, < 2.41.0.

**Is there a fix for CVE-2026-44848?** Yes. github.com/portainer/portainer (Go): upgrade to 2.33.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44848 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-44848?** Check whether you run github.com/portainer/portainer (Go), Portainer or Portainer Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/portainer/portainer (Go): upgrade to 2.33.8 or later

  ```sh
  go get github.com/portainer/portainer@v2.33.8
  ```


## Technical details

A missing authorization vulnerability exists in Portainer's Docker API proxy layer. The proxy uses a prefix-based allowlist to route requests to handlers that enforce Role-Based Access Control (RBAC); however, the '/plugins' prefix was omitted from this map. Consequently, requests to plugin management endpoints fall through to a default execution function that forwards them to the Docker daemon without any authorization checks. An authenticated user with standard access to a Docker endpoint can pull, install, and enable arbitrary Docker plugins. Because Docker plugins can be configured with 'CAP_SYS_ADMIN' privileges and host-path mounts, an attacker can achieve full remote code execution and filesystem access as root on the host machine.

## Affected products

- Portainer Portainer >= 2.33.0, < 2.33.8; >= 2.39.0, < 2.39.2; >= 2.40.0, < 2.41.0

## Identifiers

- CVE-2026-44848
- GHSA-rrmm-9v76-h3p4
- GO-2026-5639

## Timeline

- 2026-03-16: disclosed: Reported by Henrique Pereira (ikkebr) via GitHub Security Advisory
- 2026-04-20: patched: Fix merged to development and release branches
- 2026-04-29: advisory: Version 2.41.0 released
- 2026-05-07: advisory: Versions 2.39.2-LTS and 2.33.8-LTS released

## References

- [https://api.github.com/users/ikkebr](https://api.github.com/users/ikkebr)
- [https://github.com/ikkebr](https://github.com/ikkebr)
- [https://api.github.com/users/ikkebr/gists%7B/gist_id%7D](https://api.github.com/users/ikkebr/gists%7B/gist_id%7D)
- [https://api.github.com/users/ikkebr/repos](https://api.github.com/users/ikkebr/repos)
- [https://avatars.githubusercontent.com/u/356826?v=4](https://avatars.githubusercontent.com/u/356826?v=4)
- [https://api.github.com/users/ikkebr/events%7B/privacy%7D](https://api.github.com/users/ikkebr/events%7B/privacy%7D)

## Related threats

- [Portainer Community Edition improper authentication in setup endpoints](https://junglewise.ai/threats/cve-2026-55761-portainer-community-edition-improper-authentication-in-setup)
- [Portainer Community Edition directory traversal in backup restore](https://junglewise.ai/threats/cve-2026-44885-portainer-community-edition-directory-traversal-in-backup-restore)
- [Portainer Community Edition missing authorization in custom template endpoint](https://junglewise.ai/threats/cve-2026-44884-portainer-community-edition-missing-authorization-in-custom)
- [Portainer Community Edition sensitive token leakage via URL query parameter](https://junglewise.ai/threats/cve-2026-44883-portainer-community-edition-sensitive-token-leakage-via-url-query)
- [Portainer authorization bypass in Kubernetes middleware](https://junglewise.ai/threats/cve-2026-44882-portainer-authorization-bypass-in-kubernetes-middleware)