HIGH 5.9 GitHub
CVE-2026-55761
Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instances
## Summary
Portainer supports restoring an instance from a backup archive via the /api/restore endpoint. This endpoint is intentionally unauthenticated to allow restoring before the first admin account is created, and remains accessible for the five-minute initialization window that opens each time Portainer starts. Any unauthenticated attacker with network access to a Portainer instance that has not yet been initialised can exploit this window to replace the Portainer database with a crafted ar
Affected Products
- go/github.com/portainer/portainer >= 2.39.0, < 2.39.4
- go/github.com/portainer/portainer >= 2.40.0, < 2.43.0
References
- https://github.com/advisories/GHSA-x626-fcwx-f5pc
- https://github.com/portainer/portainer/security/advisories/GHSA-x626-fcwx-f5pc
- https://nvd.nist.gov/vuln/detail/CVE-2026-55761
- https://github.com/portainer/portainer/issues/2770
This high severity vulnerability with a CVSS score of 5.9 was published on 2026-08-28 via GitHub. Affected: go/github.com/portainer/portainer >= 2.39.0, < 2.39.4, go/github.com/portainer/portainer >= 2.40.0, < 2.43.0.
vulnfeed aggregates 11493 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.