Description
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer enforces seven EndpointSecuritySettings restrictions that administrators configure to restrict the container configurations non-admin users can launch: privileged mode, host PID namespace, device mapping, capabilities, sysctls, security-opt (Seccomp / AppArmor), and bind mounts. These restrictions are enforced on the standard container creation path, but several of them are not applied on the Docker Swarm service API. This vulnerability is fixed in 2.33.8, 2.39.2, and 2.41.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| portainer | portainer | >= 2.33.0, < 2.33.8, >= 2.39.0, < 2.39.2, >= 2.40.0, < 2.41.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/portainer/portainer | >= 2.33.0, < 2.33.8 | 2.33.8 | GHSA-5fxq-qcf3-244w |
| Go | github.com/portainer/portainer | >= 2.39.0, < 2.39.2 | 2.39.2 | GHSA-5fxq-qcf3-244w |
| Go | github.com/portainer/portainer | >= 2.40.0, < 2.41.0 | 2.41.0 | GHSA-5fxq-qcf3-244w |
| Go | github.com/portainer/portainer | all versions | — | GO-2026-5143 |
Advisories 1
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026