CVE-2026-33590: Insecure default permissions in Portainer CE

Synopsis

An insecure default permissions vulnerability in Portainer Community Edition allows a regular, non-administrative authenticated user to escape the container boundary and access the underlying host. The flaw is reachable over the network and requires only a low-privilege account with endpoint access, derived from the CVSS vector (AV:N, PR:L). Successful exploitation gives an attacker read access to host filesystem files and root-equivalent code execution on the host. Patched-image rebuilds at versions 2.38.0 and 2.39.0 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Portainer CE service over the network; no local or physical access to the host is required to initiate the exploit.

• AuthenticationRequired

  A valid low-privilege account with endpoint access is sufficient; no administrative credentials are needed.

• Victim interactionRequired

  The exploit path requires a user action (UI:P), meaning some degree of interaction from another party is needed to complete the attack chain.

• Attack complexityDetail

  Attack complexity is Low (AC:L) with no special timing or environmental conditions required, making the exploit reliable and repeatable.

Blast Radius

• A successful attacker reads arbitrary files from the host filesystem, including secrets, credentials, and configuration files outside any container boundary.
• The attacker executes arbitrary code at root-equivalent privilege on the underlying host, gaining full control of the node.
• Because system-level scope is marked High (SC:H, SI:H, SA:H), resources beyond the Portainer container itself are affected, including other workloads sharing the host.
• The attacker can modify persisted host-level data or crash host services, disrupting all containers running on the same node.