Is CVE-2026-44849 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44849 being exploited in the wild.

How severe is CVE-2026-44849?

High severity, with a CVSS score of 8.8, published 28 May 2026.

Which products and versions are affected?

github.com/portainer/portainer (Go) SEMVER:introduced=0, SEMVER:introduced=2.33.0,fixed=2.33.8; Portainer >= 2.33.0, = 2.39.0, = 2.40.0, < 2.41.0; Portainer Community Edition 2.33.0 to < 2.33.8, 2.39.0 to < 2.39.2, 2.40.0 to < 2.41.0.

Is there a fix for CVE-2026-44849?

Yes. github.com/portainer/portainer (Go): upgrade to 2.33.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44849 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-44849?

Check whether you run github.com/portainer/portainer (Go), Portainer or Portainer Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44849: Portainer Community Edition endpoint security bypass in Docker Swarm API

Q: Is there a fix for CVE-2026-44849?

Yes. github.com/portainer/portainer (Go): upgrade to 2.33.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44849 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-44849?

Check whether you run github.com/portainer/portainer (Go), Portainer or Portainer Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44849 · Severity: high · CVSS 8.8 · Published 2026-05-28

Portainer is a management platform used to configure and deploy containerized applications. A security flaw allows non-administrative users with access to Docker Swarm environments to bypass safety restrictions and launch containers with unauthorized privileges. This could allow an attacker to gain full control over the underlying host server, potentially leading to data theft or complete service disruption.

Technologies: github.com/portainer/portainer (Go), Portainer, Portainer Community Edition. Vendors: Go, Portainer.

Quick answers

Is CVE-2026-44849 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44849 being exploited in the wild.
How severe is CVE-2026-44849?: High severity, with a CVSS score of 8.8, published 28 May 2026.
Which products and versions are affected?: github.com/portainer/portainer (Go) SEMVER:introduced=0, SEMVER:introduced=2.33.0,fixed=2.33.8; Portainer >= 2.33.0, < 2.33.8; >= 2.39.0, < 2.39.2; >= 2.40.0, < 2.41.0; Portainer Community Edition 2.33.0 to < 2.33.8, 2.39.0 to < 2.39.2, 2.40.0 to < 2.41.0.
Is there a fix for CVE-2026-44849?: Yes. github.com/portainer/portainer (Go): upgrade to 2.33.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44849 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44849?: Check whether you run github.com/portainer/portainer (Go), Portainer or Portainer Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/portainer/portainer (Go): upgrade to 2.33.8 or later
```
go get github.com/portainer/portainer@v2.33.8
```

Technical details

Portainer fails to validate several EndpointSecuritySettings (including capabilities, sysctls, and security options) when processing Docker Swarm service requests. Specifically, the 'POST /services/create' endpoint uses a partial Go struct that ignores security-sensitive fields, while 'POST /services/{id}/update' lacks security setting validation entirely. Additionally, a flaw in bind-mount detection allows users to bypass restrictions by using volume driver options that emulate bind mounts. An authenticated user with standard access to a Swarm endpoint can exploit these omissions to deploy containers with elevated privileges (e.g., CAP_SYS_ADMIN) or mount the host root filesystem, effectively gaining root access to the Swarm manager. Patches are available in versions 2.33.8, 2.39.2, and 2.41.0.

Affected products

Portainer Portainer >= 2.33.0, < 2.33.8; >= 2.39.0, < 2.39.2; >= 2.40.0, < 2.41.0

Identifiers

CVE-2026-44849
GHSA-5fxq-qcf3-244w
GO-2026-5143

Timeline

2026-03-12: disclosed: Private disclosure of volume-driver local-bind variant by route2shell
2026-04-05: disclosed: Disclosure of Swarm service bypass by JohannesLks
2026-04-18: patched: Fix merged to develop branch
2026-04-29: patched: Version 2.41.0 released
2026-05-07: patched: LTS versions 2.39.2 and 2.33.8 released
2026-05-14: advisory: Public advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.