CVE-2026-72533 Portainer Portainer CE - Authentication Bypass
Authenticated low-privileged users can bypass Docker proxy authorization via URL normalization flaws, gaining root access to the host.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-72533?
CVE-2026-72533 is a high-severity authentication bypass vulnerability in Portainer CE, published on 11 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoint fails to normalize request paths before applying access controls, allowing crafted requests to be interpreted differently by the proxy and the authorization layer. Successful exploitation grants the attacker root-level access to the underlying Docker host.
Weakness: CWE-287
Which versions are affected by CVE-2026-72533?
How do I fix CVE-2026-72533?
No fix has been published for CVE-2026-72533 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-72533 being exploited?
There is no known exploitation of CVE-2026-72533 in the wild and no public exploit code.
Sources
Also known as GHSA-588v-59vc-3xh9.