CVE-2026-55761

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. In versions 2.39.0 through 2.39.3 and 2.40.0 until 2.43.0, unauthenticated restore and administrator initialization endpoints (/api/restore and /api/users/admin/init) remain accessible during the five-minute setup window for uninitialized instances, allowing a network attacker to restore a crafted backup or create the first administrator account and gain full administrative access. This issue is fixed in versions 2.39.4 and 2.43.0.

• CWE-287

• https://github.com/portainer/portainer/commit/49f19107cf9a3540cbe406c9eb7f24390e1af02bPatch
• https://github.com/portainer/portainer/commit/d2b56efcb4e43c4168bb6688eee9f6bf22867312Patch
• https://github.com/portainer/portainer/issues/2770Issue Tracking
• https://github.com/portainer/portainer/releases/tag/2.39.4Release Notes
• https://github.com/portainer/portainer/releases/tag/2.43.0Release Notes
• https://github.com/portainer/portainer/security/advisories/GHSA-x626-fcwx-f5pcExploit, Mitigation, Vendor Advisory

Published

Jul 8, 2026

Last Modified

Jul 10, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55748OpenStack Horizon before 25.7.4 produces scripts for OpenSta…6.8
• CVE-2026-5575A vulnerability was detected in SourceCodester/jkev Record M…7.3
• CVE-2026-55758CC: Tweaked is a mod for Minecraft which adds programmable c…6.9
• CVE-2026-55759Rocket.Chat is an open-source, secure, fully customizable co…7.4
• CVE-2026-5576A flaw has been found in SourceCodester/jkev Record Manageme…4.7
• CVE-2026-55760Handlebars.java provides logic-less and semantic Mustache te…7.5
• CVE-2026-55762Rocket.Chat is an open-source, secure, fully customizable co…8.1
• CVE-2026-55763Klever-Go is the Go implementation of the Klever blockchain …8.7
• CVE-2026-55764Klever-Go is the Go implementation of the Klever blockchain …8.7
• CVE-2026-55765CloudNativePG is a platform designed to manage PostgreSQL da…8.5
• CVE-2026-55766guzzlehttp/psr7 is a PSR-7 HTTP message library implementati…4.8
• CVE-2026-55767Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, Co…5.8