https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 29 Aug 2026 01:57:42 +0000 https://vulnerability.circl.lu/sighting/07c3762a-27d7-44f6-914f-468e0108daff/export {"uuid": "07c3762a-27d7-44f6-914f-468e0108daff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55761", "type": "seen", "source": "https://gist.github.com/alon710/e4bd6c41f3caf02d2208d3310d5a1edf", "content": "# CVE-2026-55761: CVE-2026-55761: Improper Authentication Vulnerability in Portainer Community Edition\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55761\n\n## Summary\nAn improper authentication vulnerability (CWE-287) in Portainer Community Edition (CE) allows unauthenticated remote attackers to achieve full administrative takeover. During the initial five-minute uninitialized setup window, sensitive endpoints responsible for creating the initial administrator user and restoring database state are publicly accessible without authentication. Attackers can exploit this to create administrative credentials or overwrite the system state with a malicious database configuration.\n\n## TL;DR\nUninitialized Portainer CE instances expose administrative configuration and restore endpoints without authentication during the initial five-minute setup window. Remote attackers can exploit this to register admin accounts or restore malicious configurations, leading to complete instance compromise.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-287\n- **Attack Vector**: Network\n- **CVSS Score**: 7.1\n- **EPSS Score**: 0.00493\n- **EPSS Percentile**: 40.19%\n- **Impact**: Full Administrative Takeover\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Portainer Community Edition\n- **Portainer Community Edition**: >= 2.39.0, < 2.39.4 (Fixed in: `2.39.4`)\n- **Portainer Community Edition**: >= 2.40.0, < 2.43.0 (Fixed in: `2.43.0`)\n\n## Mitigation\n\n- Upgrade to Portainer CE version 2.39.4, 2.43.0, or higher.\n- Enforce network segmentation and bind setup interfaces to local loopback addresses during initialization.\n- Explicitly configure a secure custom setup token via startup parameters.\n\n**Remediation Steps:**\n1. Identify all uninitialized Portainer installations inside the network.\n2. Upgrade the container image tags to 2.39.4 or 2.43.0 in orchestration manifests.\n3. Configure the PORTAINER_SETUP_TOKEN environment variable with a strong cryptographic secret.\n4. Review container stdout logs post-startup to verify that the setup token requirement is successfully enforced.\n\n## References\n\n- [GitHub Security Advisory GHSA-x626-fcwx-f5pc](https://github.com/portainer/portainer/security/advisories/GHSA-x626-fcwx-f5pc)\n- [NVD Detail for CVE-2026-55761](https://nvd.nist.gov/vuln/detail/CVE-2026-55761)\n- [National CVE Registry Detail](https://www.cve.org/CVERecord?id=CVE-2026-55761)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55761) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-29T00:00:52.376953Z"} {"uuid": "07c3762a-27d7-44f6-914f-468e0108daff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55761", "type": "seen", "source": "https://gist.github.com/alon710/e4bd6c41f3caf02d2208d3310d5a1edf", "content": "# CVE-2026-55761: CVE-2026-55761: Improper Authentication Vulnerability in Portainer Community Edition\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55761\n\n## Summary\nAn improper authentication vulnerability (CWE-287) in Portainer Community Edition (CE) allows unauthenticated remote attackers to achieve full administrative takeover. During the initial five-minute uninitialized setup window, sensitive endpoints responsible for creating the initial administrator user and restoring database state are publicly accessible without authentication. Attackers can exploit this to create administrative credentials or overwrite the system state with a malicious database configuration.\n\n## TL;DR\nUninitialized Portainer CE instances expose administrative configuration and restore endpoints without authentication during the initial five-minute setup window. Remote attackers can exploit this to register admin accounts or restore malicious configurations, leading to complete instance compromise.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-287\n- **Attack Vector**: Network\n- **CVSS Score**: 7.1\n- **EPSS Score**: 0.00493\n- **EPSS Percentile**: 40.19%\n- **Impact**: Full Administrative Takeover\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Portainer Community Edition\n- **Portainer Community Edition**: >= 2.39.0, < 2.39.4 (Fixed in: `2.39.4`)\n- **Portainer Community Edition**: >= 2.40.0, < 2.43.0 (Fixed in: `2.43.0`)\n\n## Mitigation\n\n- Upgrade to Portainer CE version 2.39.4, 2.43.0, or higher.\n- Enforce network segmentation and bind setup interfaces to local loopback addresses during initialization.\n- Explicitly configure a secure custom setup token via startup parameters.\n\n**Remediation Steps:**\n1. Identify all uninitialized Portainer installations inside the network.\n2. Upgrade the container image tags to 2.39.4 or 2.43.0 in orchestration manifests.\n3. Configure the PORTAINER_SETUP_TOKEN environment variable with a strong cryptographic secret.\n4. Review container stdout logs post-startup to verify that the setup token requirement is successfully enforced.\n\n## References\n\n- [GitHub Security Advisory GHSA-x626-fcwx-f5pc](https://github.com/portainer/portainer/security/advisories/GHSA-x626-fcwx-f5pc)\n- [NVD Detail for CVE-2026-55761](https://nvd.nist.gov/vuln/detail/CVE-2026-55761)\n- [National CVE Registry Detail](https://www.cve.org/CVERecord?id=CVE-2026-55761)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55761) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-29T00:00:52.376953Z"} https://vulnerability.circl.lu/sighting/07c3762a-27d7-44f6-914f-468e0108daff/export Sat, 29 Aug 2026 00:00:52 +0000 https://vulnerability.circl.lu/sighting/569efc2a-6ced-433f-bafd-f7454581b2b1/export {"uuid": "569efc2a-6ced-433f-bafd-f7454581b2b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55761", "type": "seen", "source": "https://gist.github.com/alon710/e4bd6c41f3caf02d2208d3310d5a1edf", "content": "# CVE-2026-55761: CVE-2026-55761: Improper Authentication Vulnerability in Portainer Community Edition\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55761\n\n## Summary\nAn improper authentication vulnerability (CWE-287) in Portainer Community Edition (CE) allows unauthenticated remote attackers to achieve full administrative takeover. During the initial five-minute uninitialized setup window, sensitive endpoints responsible for creating the initial administrator user and restoring database state are publicly accessible without authentication. Attackers can exploit this to create administrative credentials or overwrite the system state with a malicious database configuration.\n\n## TL;DR\nUninitialized Portainer CE instances expose administrative configuration and restore endpoints without authentication during the initial five-minute setup window. Remote attackers can exploit this to register admin accounts or restore malicious configurations, leading to complete instance compromise.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-287\n- **Attack Vector**: Network\n- **CVSS Score**: 7.1\n- **EPSS Score**: 0.00493\n- **EPSS Percentile**: 40.19%\n- **Impact**: Full Administrative Takeover\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Portainer Community Edition\n- **Portainer Community Edition**: >= 2.39.0, < 2.39.4 (Fixed in: `2.39.4`)\n- **Portainer Community Edition**: >= 2.40.0, < 2.43.0 (Fixed in: `2.43.0`)\n\n## Mitigation\n\n- Upgrade to Portainer CE version 2.39.4, 2.43.0, or higher.\n- Enforce network segmentation and bind setup interfaces to local loopback addresses during initialization.\n- Explicitly configure a secure custom setup token via startup parameters.\n\n**Remediation Steps:**\n1. Identify all uninitialized Portainer installations inside the network.\n2. Upgrade the container image tags to 2.39.4 or 2.43.0 in orchestration manifests.\n3. Configure the PORTAINER_SETUP_TOKEN environment variable with a strong cryptographic secret.\n4. Review container stdout logs post-startup to verify that the setup token requirement is successfully enforced.\n\n## References\n\n- [GitHub Security Advisory GHSA-x626-fcwx-f5pc](https://github.com/portainer/portainer/security/advisories/GHSA-x626-fcwx-f5pc)\n- [NVD Detail for CVE-2026-55761](https://nvd.nist.gov/vuln/detail/CVE-2026-55761)\n- [National CVE Registry Detail](https://www.cve.org/CVERecord?id=CVE-2026-55761)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55761) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-28T22:32:24.288926Z"} {"uuid": "569efc2a-6ced-433f-bafd-f7454581b2b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55761", "type": "seen", "source": "https://gist.github.com/alon710/e4bd6c41f3caf02d2208d3310d5a1edf", "content": "# CVE-2026-55761: CVE-2026-55761: Improper Authentication Vulnerability in Portainer Community Edition\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55761\n\n## Summary\nAn improper authentication vulnerability (CWE-287) in Portainer Community Edition (CE) allows unauthenticated remote attackers to achieve full administrative takeover. During the initial five-minute uninitialized setup window, sensitive endpoints responsible for creating the initial administrator user and restoring database state are publicly accessible without authentication. Attackers can exploit this to create administrative credentials or overwrite the system state with a malicious database configuration.\n\n## TL;DR\nUninitialized Portainer CE instances expose administrative configuration and restore endpoints without authentication during the initial five-minute setup window. Remote attackers can exploit this to register admin accounts or restore malicious configurations, leading to complete instance compromise.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-287\n- **Attack Vector**: Network\n- **CVSS Score**: 7.1\n- **EPSS Score**: 0.00493\n- **EPSS Percentile**: 40.19%\n- **Impact**: Full Administrative Takeover\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Portainer Community Edition\n- **Portainer Community Edition**: >= 2.39.0, < 2.39.4 (Fixed in: `2.39.4`)\n- **Portainer Community Edition**: >= 2.40.0, < 2.43.0 (Fixed in: `2.43.0`)\n\n## Mitigation\n\n- Upgrade to Portainer CE version 2.39.4, 2.43.0, or higher.\n- Enforce network segmentation and bind setup interfaces to local loopback addresses during initialization.\n- Explicitly configure a secure custom setup token via startup parameters.\n\n**Remediation Steps:**\n1. Identify all uninitialized Portainer installations inside the network.\n2. Upgrade the container image tags to 2.39.4 or 2.43.0 in orchestration manifests.\n3. Configure the PORTAINER_SETUP_TOKEN environment variable with a strong cryptographic secret.\n4. Review container stdout logs post-startup to verify that the setup token requirement is successfully enforced.\n\n## References\n\n- [GitHub Security Advisory GHSA-x626-fcwx-f5pc](https://github.com/portainer/portainer/security/advisories/GHSA-x626-fcwx-f5pc)\n- [NVD Detail for CVE-2026-55761](https://nvd.nist.gov/vuln/detail/CVE-2026-55761)\n- [National CVE Registry Detail](https://www.cve.org/CVERecord?id=CVE-2026-55761)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55761) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-28T22:32:24.288926Z"} https://vulnerability.circl.lu/sighting/569efc2a-6ced-433f-bafd-f7454581b2b1/export Fri, 28 Aug 2026 22:32:24 +0000