CVE-2025-49593

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-49593

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49593.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-49593

Aliases

GHSA-h5jw-8c32-xfv6

Published

2025-06-17T21:27:38.542Z

Modified

2026-04-10T05:29:00.308822Z

Severity

6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Portainer HTTP Headers May Leak to Malicious Container Registries

Details

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. Prior to STS version 2.31.0 and LTS version 2.27.7, if a Portainer administrator can be convinced to register a malicious container registry, or an existing container registry can be taken over, HTTP Headers (including registry authentication credentials or Portainer session tokens) may be leaked to that registry. This issue has been patched in STS version 2.31.0 and LTS version 2.27.7.

Database specific

{
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49593.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/portainer/portainer

Affected ranges

Type: GIT
Repo: https://github.com/portainer/portainer
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

384cb53c64af78af8e1ac7ef5b0f91bad530e989

Type: GIT
Repo: https://github.com/portainer/portainer
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

b767dcb27ed253b423facd2e04ef971985950fd3

Affected versions

1.*

1.11.3

1.20.0

2.*

2.0.0

2.23.0

internal-1.*

internal-1.2.0

internal-1.3.0

internal-1.4.0

internal-1.5.0

internal-1.6.0

v0.*

v0.5

v0.6.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49593.json"