CVE-2026-55761

Name of the Vulnerable Software and Affected Versions Portainer Community Edition versions 2.39.0 through 2.39.3 Portainer Community Edition versions 2.40.0 through 2.42.x

Description Unauthenticated access to specific endpoints is possible during the five-minute setup window of uninitialized instances. A network attacker can exploit this by interacting with the '/api/restore' and '/api/users/admin/init' endpoints to restore a crafted backup or create the initial administrator account, resulting in full administrative access.

Recommendations Update versions 2.39.0 through 2.39.3 to version 2.39.4. Update versions 2.40.0 through 2.42.x to version 2.43.0.