Security readout for executives and security teams
Plain-English summary
Portainer CE accepted login tokens in URL query strings for authenticated API calls. Those URLs can be saved in proxy logs, browser history, and Referer headers. Anyone who obtains one can act as that user until the token expires, so exposure depends on affected Portainer versions and who can access recorded URLs.
Executive priority
Prioritize this as a high-impact credential exposure issue, especially in environments where Portainer manages production containers. The fix is version-based and should be scheduled quickly, with log access reviewed because leaked tokens inherit the user’s privileges.
Technical view
CVE-2026-44883 is CWE-598 in Portainer CE 2.33.0-2.33.7, 2.39.0-2.39.1, and 2.40.0-2.40.x before 2.41.0. Middleware accepted JWTs via ?token=<JWT> on authenticated API endpoints. Browser exec, attach, and pod shell features used this pattern, exposing non-admin users with those rights.
Likely exposure
Organizations running affected Portainer CE versions are exposed when users perform container attach, exec, or pod shell actions. Risk is higher where reverse-proxy logs are broadly accessible, browser history is retained, or outbound Referer headers can leak URLs to external sites.
Exploitation context
The source bundle does not show KEV listing or active exploitation. Exploitation requires a token-bearing URL to be captured from logs, browser history, or Referer leakage, then used before expiry. The default JWT lifetime is stated as 8 hours and configurable.
Researcher notes
The advisory evidence supports URL-token acceptance, JWT leakage paths, affected version ranges, impacted UI features, and fixed releases. It does not provide public exploitation evidence in the supplied bundle, so active exploitation should not be asserted.
Mitigation direction
- Upgrade Portainer CE to 2.33.8, 2.39.2, or 2.41.0.
- Check Portainer’s advisory for any additional vendor guidance.
- Restrict access to reverse-proxy and application logs containing Portainer URLs.
- Temporarily limit exec, attach, and pod shell access until upgraded.
- Treat historical URLs containing token parameters as sensitive material.
Validation and detection
- Inventory Portainer CE instances and compare versions against affected ranges.
- Confirm upgraded systems report 2.33.8, 2.39.2, 2.41.0, or later.
- Review proxy logs for Portainer API URLs containing token parameters.
- Identify users with exec, attach, or pod shell permissions.
- Check whether external navigation could receive Referer headers from Portainer sessions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-598: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-44883 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——GitHub_MVulnerability scoring details
Base CVSS 4.0 score
7.7HighVector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/portainer/portainer/security/advisories/GHSA-jvp4-q659-95mjCVE reference, GitHub_M · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use of HTTP Request With Sensitive Query String
Use of HTTP Request With Sensitive Query String represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.