Detections
Analytics

SCA: security update for github.com/portainer/portainer (GHSA-jvp4-q659-95mj)

high Tenable Self-Hosted Container Security Plugin ID 441860

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Portainer Community Edition is a lightweight service delivery platform for containerized applications that
 can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8,
 2.39.2, and 2.41.0, Portainer's authentication middleware accepts JWT bearer tokens passed as the
 ?token=<JWT> URL query parameter on any authenticated API endpoint, in addition to the standard
 Authorization: Bearer header. URLs are recorded in reverse-proxy access logs, browser history, and HTTP
 Referer headers on outbound navigation, so any JWT passed this way can be harvested by anyone with access
 to those logs or by an external site the user subsequently visits. A leaked token grants the full
 privileges of the user it was issued to, until the token expires (default 8 hours, configurable). The
 ?token= parameter was used by Portainer's browser-based container attach, exec, and pod shell features, so
 any user with exec or attach rights on a container was exposed — not only administrators. This
 vulnerability is fixed in 2.33.8, 2.39.2, and 2.41.0. (CVE-2026-44883)

Solution

Update the github.com/portainer/portainer library and its related packages to version 2.33.8 or later.

See Also

https://github.com/advisories/GHSA-jvp4-q659-95mj

Plugin Details

Severity: High

ID: 441860

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 5/14/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.94

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.6

Temporal Score: 6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-44883

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.7

Threat Score: 6.8

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/14/2026

Vulnerability Publication Date: 5/14/2026

Reference Information

CVE: CVE-2026-44883

cwe: CWE-598