Portainer Community Edition failed to enforce the configured EndpointSecuritySettings on the Docker Swarm service creation and update API. The restrictions that normally prevent non‑admin users from launching containers in privileged mode, with host PID namespaces, device mappings, additional capabilities, sysctls, security‑opt profiles, and bind mounts were ignored for services managed via Swarm. This flaw allows a user with permission to create or update a Swarm service to launch a container that bypasses these controls and gains elevated privileges on the host, potentially exposing confidential data, modifying system integrity, or disrupting availability. The weakness is a classic missing authorization error (CWE‑862).

Portainer Community Edition versions from 2.33.0 through 2.33.7, and all releases prior to 2.39.2 and prior to 2.41.0, are affected. The security fixes are included in 2.33.8, 2.39.2, and 2.41.0 and later. The vulnerability specifically applies to deployments that use Docker Swarm mode and rely on Portainer for service creation.

The CVSS score of 9.4 indicates a critical severity, with no exploitable public resources reported and the EPSS score not available. The flaw is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending legitimate Swarm service create or update requests through the Portainer UI or API, provided they have the necessary permissions. The vulnerability requires no network-facing exploitation; it only needs an authenticated role that can interact with the Swarm service API. Because the flaw bypasses security restrictions, the attacker can achieve full control over the host, representing a high-impact privilege escalation.