CVE-2026-55761 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-55761HIGH

Portainer: Unauthenticated Restore Endpoint Allows Admin Takeover on Uninitialised Portainer Instances

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   N   N   L   N    7.1   .0029   21.6     —

AFFECTED
  Product    Versions               Fixed
  portainer  >= 2.39.0, < 2.39.4 –  —

TIMELINE
  Jun 17  Reserved by GitHub_M
  Jul 8   EXPLOIT PUBLISHED — CVE-2026-55761 (portainer). Public exploit reference added.
  Jul 8   Published (CNA: GitHub_M)

CWE-287 · CNA: GitHub_M · CVSS v4.0 · 6 references · NVD status: Analyzed

Description

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. In versions 2.39.0 through 2.39.3 and 2.40.0 until 2.43.0, unauthenticated restore and administrator initialization endpoints (/api/restore and /api/users/admin/init) remain accessible during the five-minute setup window for uninitialized instances, allowing a network attacker to restore a crafted backup or create the first administrator account and gain full administrative access. This issue is fixed in versions 2.39.4 and 2.43.0.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
June 17, 2026	Reserved	Reserved by GitHub_M
July 8, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-55761 (portainer). Public exploit reference added.
July 8, 2026	Published	Published (CNA: GitHub_M)

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
portainer	portainer	—	>= 2.39.0, < 2.39.4	—

Weaknesses

CWE-287

References (6)

https://github.com/portainer/portainer/commit/49f19107cf9a3540cbe406c9eb7f24390e1af02b [Patch]
https://github.com/portainer/portainer/commit/d2b56efcb4e43c4168bb6688eee9f6bf22867312 [Patch]
https://github.com/portainer/portainer/issues/2770 [Issue Tracking]
https://github.com/portainer/portainer/releases/tag/2.39.4 [Release Notes]
https://github.com/portainer/portainer/releases/tag/2.43.0 [Release Notes]
https://github.com/portainer/portainer/security/advisories/GHSA-x626-fcwx-f5pc [Exploit, Mitigation, Vendor Advisory]

Authoritative record: CVE-2026-55761 at cve.org

Vendors: portainer

Weaknesses: CWE-287

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-55761 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.