CVE-2026-44850: Portainer: Bind-mount restriction bypass via HostConfig.Mounts

Synopsis

This is an authorization bypass vulnerability in Portainer Community Edition (versions 2.33.0 through ranges before 2.33.8, 2.39.2, and 2.41.0). The flaw is reachable over the network by any authenticated low-privilege user and requires no victim interaction. Successful exploitation lets an attacker mount arbitrary host filesystem paths into a container they create, bypassing the platform-level bind-mount restriction that administrators set to protect host data. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment upstream fix versions are confirmed published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The Portainer API is exposed over the network, so the attacker must be able to reach the service remotely to submit the malformed container-create request.

• AuthenticationRequired

  A low-privilege account with container-creation rights on a Docker environment is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  The attacker submits the crafted API request directly; no action from another user or administrator is required.

• Attack complexityDetail

  Exploitation is reliable and condition-free: the bypass requires only a well-formed container-create payload with HostConfig.Mounts instead of HostConfig.Binds, with no race conditions or special environmental state needed.

Blast Radius

• Reads arbitrary host filesystem paths, including sensitive files such as private keys, secrets, and configuration data that the container user has permission to access after mounting.
• Writes or modifies host filesystem content within the mounted path if the mount is writable, allowing tampering with host-resident files outside the container boundary.
• Enables container escape primitives by mounting paths such as /etc, /var/run/docker.sock, or similar, expanding attacker control beyond the container to the underlying host.
• Bypasses an explicitly configured administrator security control, meaning the impact extends to the integrity of the Portainer security model for the entire Docker environment.