CVE-2025-49593 Portainer HTTP Headers May Leak to Malicious Container Registries
Portainer administrators may leak session tokens and credentials to malicious registries if tricked into registering them, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-49593?
CVE-2025-49593 is a medium-severity vulnerability in portainer, published on 17 Jun 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. Prior to STS version 2.31.0 and LTS version 2.27.7, if a Portainer administrator can be convinced to register a malicious container registry, or an existing container registry can be taken over, HTTP Headers (including registry authentication credentials or Portainer session tokens) may be leaked to that registry. This issue has been patched in STS version 2.31.0 and LTS version 2.27.7.
Weakness: CWE-200
Which versions are affected by CVE-2025-49593?
How do I fix CVE-2025-49593?
No fix has been published for CVE-2025-49593 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-49593 being exploited?
There is no known exploitation of CVE-2025-49593 in the wild and no public exploit code.
Sources
Also known as GHSA-h5jw-8c32-xfv6.