CVE-2026-33590

HighCVSS 8.5/10Last modified Jun 17, 2026

Description

Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code execution. An authenticated non-administrative user with endpoint access can exploit these settings to read host files or obtain root equivalent

access on the host.

Metrics

CVSS 4.0 8.5/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-276

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: May 28, 2026
Last modified: Jun 17, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-3359110.0A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unauthenticated attacker to bypass security restriction using a s CVE-2026-335927.5An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service in open62541. The serverUris field of Fin CVE-2026-335937.5A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.CVE-2026-335947.5A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH backend, causing querie CVE-2026-335957.5A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some reso CVE-2026-335966.5A client might theoretically be able to cause a mismatch between queries sent to a backend and the received responses by sending a flood of CVE-2026-335977.5PRSD detection denial of service CVE-2026-335989.1A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on a CVE-2026-335998.1A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (CVE-2026-33607.5The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versio CVE-2026-336004.9An RPZ sent by a malicious authoritative server can result in a null pointer dereference, caused by a missing consistency check and leading CVE-2026-336014.9If you use the zoneToCache function with a malicious authoritative server, an attacker can send a zone that result in a null pointer derefer