CVE-2026-55761

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55761
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55761.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55761
Aliases
  • GHSA-x626-fcwx-f5pc
Published
2026-07-08T15:03:54.158Z
Modified
2026-07-15T01:49:15.188404831Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H CVSS Calculator
Summary
Portainer: Unauthenticated Restore Endpoint Allows Admin Takeover on Uninitialised Portainer Instances
Details

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. In versions 2.39.0 through 2.39.3 and 2.40.0 until 2.43.0, unauthenticated restore and administrator initialization endpoints (/api/restore and /api/users/admin/init) remain accessible during the five-minute setup window for uninitialized instances, allowing a network attacker to restore a crafted backup or create the first administrator account and gain full administrative access. This issue is fixed in versions 2.39.4 and 2.43.0.

Database specific 
{
    "cwe_ids": [
        "CWE-287"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55761.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/portainer/portainer

Affected ranges

Type
GIT
Repo
https://github.com/portainer/portainer
Events
Introduced
0f99e298f325d5eee2ecc798598ba45e2350eab0
Fixed
90a3374c2e8e38a0e7ccb8318da166e690546f08
Introduced
6c863bfa6787a91ab0cb45c432b53e7bf80c78f8
Fixed
e78428fa8a51fad239575e65abc85004bff9edd0
Fixed
49f19107cf9a3540cbe406c9eb7f24390e1af02b
Fixed
d2b56efcb4e43c4168bb6688eee9f6bf22867312
Database specific 
{
    "cpe": "cpe:2.3:a:portainer:portainer:*:*:*:*:community:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.39.0"
        },
        {
            "fixed": "2.39.4"
        },
        {
            "introduced": "2.40.0"
        },
        {
            "fixed": "2.43.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55761.json"