Portainer Community Edition versions 2.33.0 through 2.33.7, 2.39.0 through 2.39.1, and earlier 2.41.0 releases allow users who are not administrators to bypass the bind‑mount restriction that is intended to prevent non‑admin users from mounting host paths into containers. The enforcement check only examined the older HostConfig.Binds array and ignored the newer HostConfig.Mounts array used by the Docker API. Consequently, an authenticated user with permission to create containers on a protected Docker environment can submit a mount entry under HostConfig.Mounts and bind any host directory into the container. This grants that user read (and possible write) access to arbitrary files on the host, enabling sensitive data exposure, modification, or execution of code on the host system. The vulnerability is a direct non‑relevant access flaw (CWE‑863) that yields a high level of confidentiality and integrity compromise.

The affected product is Portainer Community Edition. Vulnerable versions include 2.33.0 through 2.33.7, 2.39.0 through 2.39.1, and the 2.41.0 release before the fix. The vulnerability is fixed in version 2.33.8 and later, version 2.39.2 and later, and version 2.41.0 and later. Users running any of these older versions should verify the current build number and plan for an upgrade.

The CVSS score of 8.5 indicates high severity, and the lack of an EPSS entry means the current exploitation probability is unknown but not explicitly low. The vulnerability is not in the CISA KEV catalog. An attacker needs only authenticated access to Portainer with container creation privileges and does not need any additional network exposure beyond the existing Portainer connection. Successful exploitation provides the attacker with privileged host access via mounted volumes, presenting a clear risk of data exfiltration or system compromise. In environments where bind mounts are enabled for non‑admins, the attack surface expands dramatically, making this an acute risk for organizations that rely on the portainer‑managed Docker workloads.