CVE-2026-44850

Name of the Vulnerable Software and Affected Versions Portainer Community Edition versions 2.33.0 through 2.33.7 Portainer Community Edition versions 2.39.0 through 2.39.1 Portainer Community Edition versions prior to 2.41.0

Description Portainer includes a security setting to disable bind mounts for non-administrators, intended to prevent regular users from binding host paths into containers via the Portainer-mediated Docker API. However, the enforcement mechanism only inspected the HostConfig.Binds array and ignored the equivalent HostConfig.Mounts array. Since both fields are interchangeable on the Docker daemon, an authenticated user with container-creation rights can bypass this restriction by submitting a bind-typed entry under HostConfig.Mounts at the 'POST /containers/create' endpoint. This allows the user to mount any host path into their container, potentially gaining read or write access to the host filesystem as the Docker daemon user (typically root). This can lead to the exposure of sensitive files, compromise of other containers on the same host, or full Docker API access if the Docker socket is mounted.

Recommendations Update Portainer Community Edition versions 2.33.0 through 2.33.7 to 2.33.8. Update Portainer Community Edition versions 2.39.0 through 2.39.1 to 2.39.2. Update Portainer Community Edition versions prior to 2.41.0 to 2.41.0. Revoke container-create rights from non-administrator accounts on affected environments. Segregate tenants by environment to provide stronger control than the bind-mount toggle.