Skip to content
Threat Feed

Tag

CVE-2026-44848

1 brief RSS
critical advisory

Portainer Missing Authorization on Docker Plugin Endpoints Leads to Host RCE (CVE-2026-44848)

Portainer versions 2.33.0 through 2.33.7, 2.39.0 through 2.39.1, and 2.40.0 expose a missing authorization vulnerability (CVE-2026-44848) on the Docker plugin management endpoints, allowing a non-admin user with access to a Docker endpoint to install and enable arbitrary Docker plugins from any registry, ultimately leading to root privileges on the Docker host and unauthorized file system access.

Portainer +3 privilege-escalation execution CVE-2026-44848
2r 1t