Portainer Endpoint Security Bypass Under Investigation
An early warning has been issued regarding a potential security bypass in Portainer's endpoint for Swarm service creation and updates. Non-admin users may be able to bypass security settings.
What happened
Reportedly, Portainer has an endpoint security bypass via Swarm service create/update, tracked under GHSA-5FXQ-QCF3-244W. This issue appears to allow non-admin users to bypass security settings when creating or updating Docker Swarm services. The severity of this issue is under investigation, but it is currently classified as HIGH. Affected components include the Portainer (go) package.
Professional software engineers using Portainer are advised to review and update their Portainer configurations to ensure that security settings are properly enforced for all users. Detailed information can be found in the GitHub Advisory Database under GHSA-5fxq-qcf3-244w.
For more information and to stay updated on this developing situation, consult the primary sources. The exact impact and necessary mitigations are still under investigation, so it is crucial to monitor updates from trusted sources.
How 0Day mitigates this
portainer is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.