TL;DR: Portainer CE through version 2.44.0 has an authentication bypass in its Docker proxy endpoint. A low-privileged authenticated user can craft non-canonical URL paths that the authorization layer interprets differently from the proxy itself, defeating all access controls and gaining root-level access to the underlying Docker host. No fix is available yet.

What happened

The vulnerability lives in how Portainer CE's Docker proxy endpoint handles URL paths. When a request arrives, the proxy passes it through an authorization middleware layer that checks whether the user has permission to access the requested Docker resource. The problem is path normalization mismatch.

Portainer's authorization middleware normalizes URLs one way. The Docker proxy on the back end normalizes them another way. An attacker can construct a request path with sequences like double slashes, encoded dot segments, or trailing dots that resolve to the same Docker endpoint after normalization but appear as a different, permitted path during the authorization check. The middleware sees a path it thinks the user is allowed to access. The proxy sees the actual restricted endpoint and executes it.

This is not a minor privilege escalation. The Docker proxy mediates all Docker API calls on the host. Bypassing it means the attacker can create containers, mount the host filesystem, execute arbitrary commands, and pivot to any other container on the node. In practice, this is full compromise of the Docker host with root privileges.

What is Portainer CE

Portainer CE (Community Edition) is the open source version of Portainer, a container management platform that provides a web UI for Docker and Kubernetes. Administrators use it to deploy containers, manage stacks, configure networks, and monitor environments without touching the CLI. It runs as a container itself and connects to the Docker socket on the host, which means it operates with the full privileges of the Docker daemon.

Portainer CE is deployed widely in self-hosted environments, homelabs, and small to mid-size production clusters. The Portainer Docker image has over 1 billion pulls on Docker Hub. Organizations rely on it as the primary management interface for container infrastructure where Kubernetes native tooling is too heavy or unnecessary.

Who is affected

Any deployment running Portainer CE through version 2.44.0 is vulnerable. The exploit requires the attacker to hold any authenticated account on the Portainer instance, including low-privileged users who only have access to a restricted subset of containers or environments. In deployments with self-service portals or multi-tenant configurations where external users have Portainer accounts, the risk is substantially higher.

Portainer Business Edition (BE) has its own authorization pipeline and is not affected by this specific path normalization issue. Only CE versions through 2.44.0 are in scope.

What to do

No patched version is available at the time of writing. Mitigations:

• Restrict Portainer network exposure. Put Portainer behind a VPN or restrict access to trusted IP ranges. If attackers cannot reach the login page, they cannot exploit this bypass.
• Audit user accounts. Remove any low-privileged or guest accounts that do not need Portainer access. The exploit requires an authenticated session, so reducing the account surface reduces exposure.
• Monitor Docker proxy logs. Look for requests containing double slashes, encoded dot segments (%2e), or paths that do not match expected container or endpoint names.
• Run Portainer with read-only Docker socket access if your workflow allows it. This limits what an attacker can do even if the bypass succeeds.

Watch for a fix in the next Portainer CE release. The project has not published an advisory with a target version yet as of the CVE publication date.

Why it matters

Container orchestration platforms are high-value targets. Portainer manages Docker hosts directly, so any authentication bypass in its proxy layer is effectively a gateway to the entire container infrastructure. The path normalization class of vulnerability is well understood but keeps appearing because URL handling is split across multiple layers in most web applications. Each layer normalizes differently, and the gaps between them become attack surface.

This CVE has no CVSS score assigned yet from NVD. The effective severity from the source advisory is listed as unknown. Based on the technical description, the impact is high: an authenticated low-privileged user escalates to root on the Docker host. Whether it qualifies as critical depends on the authentication requirement, which limits it to insider threats or accounts compromised through other means.

References

• CVE-2026-72533 on hol.org
• Portainer CE GitHub repository
• Portainer official site