Portainer CE: non-canonical URL path defeats Docker proxy authorization, granting root on the Docker host

Impact

The Docker proxy endpoint applies access control before normalizing the request path, so the proxy and the authorization layer disagree about what is being called and crafted paths slip past every authorization middleware. A low-privileged Portainer user - a tenant given a scoped environment or a single stack - reaches the raw Docker API and can create a privileged container, which is root on the underlying host. On a GPU node that means the attacker owns the device nodes, the driver interfaces and any other tenant's containers scheduled there, and the host must be treated as compromised rather than merely restarted. Affects Portainer CE through 2.44.0.

Who can reach it

Any authenticated Portainer user, including the lowest privilege level, who can reach the Portainer web interface over the network. No administrator role and no local access needed.

What to do

The record cites only the project repository and names no fixed release beyond 2.44.0 - check the Portainer release notes for a version after 2.44.0 and upgrade, which is a container image replacement and Portainer restart. Until a fixed build is confirmed, remove non-admin Portainer accounts, restrict who can reach the interface, and treat any host managed by an exposed Portainer as potentially compromised.

References

Related entries

• Dokploy: WebSocket handlers skip per-server authorization, giving any org member root terminalsCVE-2026-72883 · Dokploy (WebSocket terminal, container-terminal, logs and stats handlers)High
• OpenChoreo: workflow parameters interpolated into sh -c run as commands in privileged build podsCVE-2026-73667 · OpenChoreo Workflow Plane (sample workflow templates, sh -c parameter interpolation)High
• OpenChoreo API: project-scoped users can exec into and read wirelogs of other projects' componentsCVE-2026-73841 · OpenChoreo openchoreo-api (component exec and wirelogs handlers)High
• KubeEdge CloudCore: unauthenticated node task status reports let anyone falsify node upgrade resultsCVE-2026-82473 · KubeEdge CloudCore (CloudHub HTTPS server, node task status endpoints)High
• CRI-O: restoring a malicious checkpoint keeps the source security context and bypasses pod policyCVE-2026-92574 · CRI-O (checkpoint/restore container restore path)High
• Arcane: delegated users:update permission lets any operator reset the global administrator passwordCVE-2026-96627 · Arcane Docker management UI (UpdateUser in backend/api/handlers/users.go)High