CVE-2026-72533
Portainer Portainer CE - Authentication Bypass
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoint fails to normalize request paths before applying access controls, allowing crafted requests to be interpreted differently by the proxy and the authorization layer. Successful exploitation grants the attacker root-level access to the underlying Docker host.
| CWE | CWE-287 |
| Vendor | portainer |
| Product | portainer ce |
| Published | Aug 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for portainer portainer ce
Be the first to know when new high vulnerabilities affecting portainer portainer ce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Portainer / Portainer CE
0 ≤ 2.44.0
Credits
Bobur Abdugafforov (Mahadsec)