CVE-2026-55761: Portainer Community Edition improper authentication in setup endpoints

CVE-2026-55761 · Severity: medium · CVSS 5.9 · Published 2026-07-08

Portainer's backup restore endpoint is intentionally left unauthenticated during the first five minutes after startup to allow recovery before an admin account is created. An attacker with network access to an uninitialized instance can exploit this window to upload a malicious backup containing their own admin credentials, gaining full control of the Portainer platform and all connected Docker hosts and Kubernetes clusters. The attack requires no authentication, user interaction, or technical expertise, but only succeeds if the instance hasn't been initialized yet and is reachable from the attacker's network.

Technologies: github.com/portainer/portainer (Go), Portainer, Portainer Community Edition. Vendors: Go, Portainer.

Quick answers

Is CVE-2026-55761 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55761 being exploited in the wild.
How severe is CVE-2026-55761?
Medium severity, with a CVSS score of 5.9, published 8 July 2026.
Which products and versions are affected?
github.com/portainer/portainer (Go) SEMVER:introduced=0, SEMVER:introduced=2.39.0,fixed=2.39.4; Portainer 2.39.0 to 2.39.3, 2.40.0 to 2.42.x (all 2.40+ prior to 2.43.0); Portainer Community Edition 2.39.0 - 2.39.3, 2.40.0 - 2.42.x.
Is there a fix for CVE-2026-55761?
Yes. github.com/portainer/portainer (Go): upgrade to 2.39.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55761 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-55761?
Check whether you run github.com/portainer/portainer (Go), Portainer or Portainer Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/portainer/portainer (Go): upgrade to 2.39.4 or later
    go get github.com/portainer/portainer@v2.39.4

Technical details

The vulnerability is an authentication bypass in the `/api/restore` endpoint (api/http/handler/backup/handler.go and restore.go), which is deliberately marked with `bouncer.PublicAccess` to bypass all authentication middleware. The restore handler only checks whether the instance has been initialized before proceeding; if not, it unconditionally restores the uploaded archive. An attacker can craft a backup containing a malicious database with their own administrator credentials and upload it via POST to `/api/restore` during the five-minute uninitialized window that opens each time Portainer starts. Once restored, the attacker can authenticate as the admin account they inserted. The same vulnerability affects the `/api/users/admin/init` endpoint, which can be called to create an admin account directly. The fix introduces a cryptographically random setup token generated at startup and logged to the console; both endpoints now require this token in the `X-Setup-Token` HTTP header. Deployments that pre-provision an admin password via `--admin-password` or `--admin-password-file` bypass the token requirement entirely. Patches are available in Portainer 2.39.4 (LTS) and 2.43.0 (STS); earlier versions do not receive fixes.

Affected products

  • Portainer Portainer 2.39.0 to 2.39.3, 2.40.0 to 2.42.x (all 2.40+ prior to 2.43.0)

Identifiers

  • CVE-2026-55761
  • GHSA-x626-fcwx-f5pc
  • GO-2026-6324

Timeline

  • 2026-05-07: disclosed: Reported privately by um3b0shi
  • 2026-06-04: patched: Fix merged to develop branch
  • 2026-06-24: patched: 2.43.0 (STS) released with fix
  • 2026-06-25: patched: 2.39.4 (LTS) released with backported fix
  • 2026-08-28: advisory: Public advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.