Executive brief
Portainer's backup restore endpoint is intentionally left unauthenticated during the first five minutes after startup to allow recovery before an admin account is created. An attacker with network access to an uninitialized instance can exploit this window to upload a malicious backup containing their own admin credentials, gaining full control of the Portainer platform and all connected Docker hosts and Kubernetes clusters. The attack requires no authentication, user interaction, or technical expertise, but only succeeds if the instance hasn't been initialized yet and is reachable from the attacker's network.
Technical details
The vulnerability is an authentication bypass in the `/api/restore` endpoint (api/http/handler/backup/handler.go and restore.go), which is deliberately marked with `bouncer.PublicAccess` to bypass all authentication middleware. The restore handler only checks whether the instance has been initialized before proceeding; if not, it unconditionally restores the uploaded archive. An attacker can craft a backup containing a malicious database with their own administrator credentials and upload it via POST to `/api/restore` during the five-minute uninitialized window that opens each time Portainer starts. Once restored, the attacker can authenticate as the admin account they inserted. The same vulnerability affects the `/api/users/admin/init` endpoint, which can be called to create an admin account directly. The fix introduces a cryptographically random setup token generated at startup and logged to the console; both endpoints now require this token in the `X-Setup-Token` HTTP header. Deployments that pre-provision an admin password via `--admin-password` or `--admin-password-file` bypass the token requirement entirely. Patches are available in Portainer 2.39.4 (LTS) and 2.43.0 (STS); earlier versions do not receive fixes.
Affected products
- Portainer Portainer 2.39.0 to 2.39.3, 2.40.0 to 2.42.x (all 2.40+ prior to 2.43.0)
Timeline
- 2026-05-07: disclosed: Reported privately by um3b0shi
- 2026-06-04: patched: Fix merged to develop branch
- 2026-06-24: patched: 2.43.0 (STS) released with fix
- 2026-06-25: patched: 2.39.4 (LTS) released with backported fix
- 2026-08-28: advisory: Public advisory published