CVE-2025-49593
Last modified
CVE-2025-49593 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. Prior to STS version 2.31.0 and LTS version 2.27.7, if a Portainer administrator can be convinced to register a malicious container registry, or an existing container registry can be taken over, HTTP Headers (including registry authentication credentials or Portainer session tokens) may be leaked to that registry. EPSS estimates a 0.35% chance of exploitation in the next 30 days.
Description
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. Prior to STS version 2.31.0 and LTS version 2.27.7, if a Portainer administrator can be convinced to register a malicious container registry, or an existing container registry can be taken over, HTTP Headers (including registry authentication credentials or Portainer session tokens) may be leaked to that registry. This issue has been patched in STS version 2.31.0 and LTS version 2.27.7.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-49593?
How severe is CVE-2025-49593?
How do I fix CVE-2025-49593?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-49587XWiki is an open-source wiki software platform. When a user …8
- CVE-2025-49588Linkwarden is a self-hosted, open-source collaborative bookm…8.7
- CVE-2025-49589PCSX2 is a free and open-source PlayStation 2 (PS2) emulator…6.1
- CVE-2025-49590CryptPad is a collaboration suite. Prior to version 2025.3.0…6.1
- CVE-2025-49591CryptPad is a collaboration suite. Prior to version 2025.3.0…9.1
- CVE-2025-49592n8n is a workflow automation platform. Versions prior to 1.9…5.4
- CVE-2025-49594XWiki OIDC has various tools to manipulate OpenID Connect pr…9.2
- CVE-2025-49595n8n is a workflow automation platform. Prior to version 1.99…4.9
- CVE-2025-49596The MCP inspector is a developer tool for testing and debugg…9.4
- CVE-2025-49597handcraftedinthealps goodby-csv is a highly memory efficient…3.9
- CVE-2025-49598conda-forge-ci-setup is a package installed by conda-forge e…4.4
- CVE-2025-49599Huawei EG8141A5 devices through V5R019C00S100, EG8145V5 devi…4.1
Are you affected by CVE-2025-49593?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST