CVE-2026-44881_exploit

CVE-2026-44881 — Portainer Git シンボリックリンク → 任意のホストファイル読み取り CVE-2026-44881 のシングルスクリプトエクスプロイト。Portainer のスタックデプロイフローにおける Git シンボリックリンク注入により、スタック作成権限を持つ低権限の認証ユーザーが Portainer プロセスからアクセス可能な任意のファイルを読み取ることができます。 アドバイザリ: GHSA-rpgq-m5fp-32wr 影響を受けるバージョン: Portainer CE 2.33.0 – 2.33.7、2.39.0 – 2.39.1、2.40.x...

CVE-2026-11876

In zenml-io/zenml version 0.94.2, the GET /api/v1/stack-deployment/stack endpoint getdeployedstack lacks proper RBAC authorization checks, allowing any authenticated user to enumerate all deployed stacks across all users and tenants. This includes stack component details, service connector...

PT-2026-61943

In zenml-io/zenml version 0.94.2, the GET /api/v1/stack-deployment/stack endpoint get deployed stack lacks proper RBAC authorization checks, allowing any authenticated user to enumerate all deployed stacks across all users and tenants. This includes stack component details, service connector...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Portainer

CVE-2026-44881 — Portainer Git Symlink → Arbitrary Host File R...

CVE-2026-44881 Portainer: Arbitrary File Read via Git Symlink Injection in Stack Auto-Update

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer supports deploying stacks from Git repositories. When a...