CVE-2026-55761

Portainer: Unauthenticated Restore Endpoint Allows Admin Takeover on Uninitialised Portainer Instances

Published Jul 8, 2026 CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Description

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. In versions 2.39.0 through 2.39.3 and 2.40.0 until 2.43.0, unauthenticated restore and administrator initialization endpoints (/api/restore and /api/users/admin/init) remain accessible during the five-minute setup window for uninitialized instances, allowing a network attacker to restore a crafted backup or create the first administrator account and gain full administrative access. This issue is fixed in versions 2.39.4 and 2.43.0.

Analysis

Technical impact

Unauthenticated access to the /api/restore endpoint and the /api/users/admin/init endpoint remains available during the five-minute setup window for uninitialized Portainer Community Edition instances. An attacker can craft and restore a malicious backup or create the first administrator account, thereby obtaining unrestricted administrative privileges. This represents an authentication bypass flaw (CWE-287).

Affected Systems

Portainer Community Edition releases 2.39.0 through 2.39.3 and 2.40.0 through 2.43.0 are affected; the flaw exists only while the instance is still uninitialized.

Risk and Exploitability

The CVSS score of 7.1 indicates high severity, and the EPSS score of less than 1% signals a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. A network attacker with visibility during the initial configuration window can exploit the unauthenticated endpoints to establish full administrative control over the uninitialized environment.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

portainer

affected

Version	Status	Constraints
`>= 2.39.0, < 2.39.4`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:portainer:portainer:::::community:::*
	cpe:2.3:a:portainer:portainer:::::community:::*

No data.

Vendor Product Versions

Portainer

Version	Status	Scheme	Platform
`[2.39.0,2.39.4)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to release 2.39.4 or later, which removes the unauthenticated restore and admin initialization endpoints.
Enforce firewall rules or network policies that block external traffic to the Portainer deployment during the initial setup window.
Deploy a temporary reverse proxy rule that denies unauthenticated requests to the /api/restore and /api/users/admin/init endpoints during the initial setup period.

Generated by OpenCVE AI on August 12, 2026 at 10:10 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-x626-fcwx-f5pc	Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instances

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.493% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/portainer/portainer/commit/49f19107cf9a3540cbe406c9eb7f24390e1af02b
https://github.com/portainer/portainer/commit/d2b56efcb4e43c4168bb6688eee9f6bf22867312
https://github.com/portainer/portainer/issues/2770
https://github.com/portainer/portainer/releases/tag/2.39.4
https://github.com/portainer/portainer/releases/tag/2.43.0
https://github.com/portainer/portainer/security/advisories/GHSA-x626-fcwx-f5pc

History

Jul 8, 2026 5:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Portainer Portainer portainer
Vendors & Products		Portainer Portainer portainer

Jul 8, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 8, 2026 3:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. In versions 2.39.0 through 2.39.3 and 2.40.0 until 2.43.0, unauthenticated restore and administrator initialization endpoints (/api/restore and /api/users/admin/init) remain accessible during the five-minute setup window for uninitialized instances, allowing a network attacker to restore a crafted backup or create the first administrator account and gain full administrative access. This issue is fixed in versions 2.39.4 and 2.43.0.
Title		Portainer: Unauthenticated Restore Endpoint Allows Admin Takeover on Uninitialised Portainer Instances
Weaknesses		CWE-287
References		https://github.com/portainer/portainer/commit/49f19107cf9a3540cbe406c9eb7f24390e1af02b https://github.com/portainer/portainer/commit/d2b56efcb4e43c4168bb6688eee9f6bf22867312 https://github.com/portainer/portainer/issues/2770 https://github.com/portainer/portainer/releases/tag/2.39.4 https://github.com/portainer/portainer/releases/tag/2.43.0 https://github.com/portainer/portainer/security/advisories/GHSA-x626-fcwx-f5pc
Metrics		cvssV4_0 `{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H'}`