CVE-2026-44882
Kubernetes Authorization Bypass in Portainer Community Edition
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| portainer | community_edition | 2.33.8 |
| portainer | community_edition | From 2.33.0 (inc) to 2.33.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Portainer Community Edition versions from 2.33.0 up to but not including 2.33.8. Portainer uses a middleware layer called kubeClientMiddleware to proxy requests to Kubernetes clusters and validate user tokens before forwarding traffic. However, when the token validation function security.RetrieveTokenData returned an error, the middleware responded with an HTTP 403 error but failed to stop execution. As a result, the request continued with a nil tokenData value, causing the authorization check to be bypassed.
This means that a user with a valid Portainer session but without permission to access certain Kubernetes endpoints could still have their requests forwarded to the cluster, effectively bypassing the intended authorization controls.
The issue affected both the Community Edition and Enterprise Edition codebases and was fixed in version 2.33.8.
How can this vulnerability impact me? :
This vulnerability can allow an attacker who has a valid Portainer session but lacks proper permissions to access certain Kubernetes endpoints to bypass authorization checks and interact with those endpoints anyway.
The impact includes unauthorized access to Kubernetes cluster resources, which can lead to exposure or modification of sensitive data and potentially compromise the integrity of containerized applications managed through Portainer.
According to the CVSS score of 8.1, the vulnerability is considered high severity, with high impact on confidentiality and integrity but no impact on availability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Portainer Community Edition to version 2.33.8 or later, where the issue has been fixed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows low-privileged users with valid Portainer sessions to bypass authorization checks and access Kubernetes endpoints they are not authorized to reach. This unauthorized access can lead to reading or modifying sensitive cluster resources such as pods, secrets, or deployments.
Such unauthorized access and potential exposure or modification of sensitive data could negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict access controls and protection of confidential information.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability exists in Portainer versions 2.33.0 through 2.33.7 where the Kubernetes middleware improperly processes requests after token validation fails, allowing unauthorized access to Kubernetes endpoints.
To detect if your system is vulnerable, first verify the Portainer version running in your environment. If it is between 2.33.0 and 2.33.7, your system is potentially affected.
You can check the Portainer version by running the following command on the host where Portainer is installed:
- docker ps --filter "name=portainer" --format "{{.Image}}"
- docker exec -it <portainer_container_id_or_name> portainer --version
Additionally, monitoring HTTP 403 responses from Portainer's Kubernetes endpoints followed by unexpected successful access attempts could indicate exploitation attempts. However, no specific detection commands or signatures are provided in the available resources.
The recommended mitigation is to upgrade Portainer to version 2.33.8 or later.