CVE-2026-55761: Portainer Community Edition Unauthenticated Admin Access Vulnerability

Technical summary

The vulnerability exists in Portainer Community Edition versions 2.39.0–2.39.3 and 2.40.0–2.42.x. The /api/restore and /api/users/admin/init endpoints lack proper authentication enforcement during the uninitialized setup phase, which remains open for five minutes after deployment. CWE-287 (Improper Authentication) describes the underlying defect. An attacker can POST to these endpoints without credentials to either call the restore function with a crafted backup payload or invoke the admin initialization endpoint to create the first administrator account, bypassing intended administrative controls.

Business impact

Successful exploitation grants an attacker immediate administrative access to the Portainer instance, enabling full control over containerized application deployments across Docker, Swarm, Kubernetes, or ACI environments. This can result in container manipulation, data exfiltration, lateral movement into orchestrated workloads, or service disruption. Organizations relying on Portainer for infrastructure management face operational risk, compliance exposure (especially in regulated sectors), and potential downstream compromise of applications running in managed containers.

Affected systems

Portainer Community Edition versions 2.39.0 through 2.39.3 and 2.40.0 through 2.42.x are vulnerable. Fixed versions are 2.39.4 and 2.43.0 or later. The vulnerability is present only during fresh, uninitialized deployments within the first five minutes of startup. Already-initialized Portainer instances are not affected because the endpoints are protected once setup is complete.

Exploitability

Exploitability is moderate. An attacker requires network access to the Portainer API endpoint, but authentication is absent during the setup window. No user interaction is required. The five-minute window provides a narrow but meaningful exposure window—particularly dangerous in cloud or container lab environments where instances may be provisioned dynamically and left unattended during initialization. Automated scanning and exploitation during infrastructure spin-up are plausible attack vectors.

Remediation

Upgrade immediately to Portainer Community Edition version 2.39.4 (for 2.39.x branch) or 2.43.0 (for 2.40+ branch). For organizations unable to upgrade immediately, implement network-level segmentation to restrict unauthenticated access to the Portainer API during deployment. Ensure Portainer instances are placed behind a load balancer or firewall that enforces authentication at the perimeter, and monitor initialization logs for suspicious /api/restore or /api/users/admin/init requests during the setup phase.

Patch guidance

Verify the available patches against the Portainer release notes and your deployment architecture. For Portainer Community Edition deployed via Docker, update the container image to 2.39.4 or 2.43.0+. For Kubernetes deployments, update the Helm chart or manifest to reference a patched image version. Test patches in a non-production environment first, particularly if you are running orchestrated workloads. No data migration or complex configuration changes are required post-patch, though restarting the Portainer service is necessary.

Detection guidance

Monitor API logs for unauthenticated POST requests to /api/restore or /api/users/admin/init during startup. Examine Portainer initialization events and audit logs for unexpected admin account creation. Implement Network Detection and Response (NDR) or API gateway logging to flag unauthenticated calls to these endpoints. In container orchestration environments, watch for rapid instance provisioning followed immediately by initialization endpoint activity from unexpected source IPs. Alert on any restore operation triggered outside normal maintenance windows.

Why prioritize this

Although the CVSS score is 5.9 (Medium), the vulnerability's ability to grant complete administrative control over containerized infrastructure justifies higher operational priority in environments where Portainer manages production workloads. The narrow five-minute exposure window and the requirement for network access are mitigating factors, but the integrity impact (I:H) and the prevalence of Portainer in microservices deployments elevate practical risk. Organizations with externally facing or internet-connected Portainer API endpoints should patch urgently.

Risk score, explained

The CVSS 3.1 score of 5.9 reflects a network-accessible vulnerability (AV:N) with high integrity impact (I:H) but no confidentiality or availability damage, and an assumption that exploitation requires some specialized conditions (AC:H, likely referring to the five-minute window timing). However, this score may underweight the business risk of administrative takeover in container orchestration contexts. Security teams should consider compensating controls and exposure level when deciding priority.

Frequently asked questions