Information disclosure in Portainer
CVE-2025-49593
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. Prior to STS version 2.31.0 and LTS version 2.27.7, if a Portainer administrator can be convinced to register a malicious container registry, or an existing container registry can be taken over, HTTP Headers (including registry authentication credentials or Portainer session tokens) may be leaked to that registry. This issue has been patched in STS version 2.31.0 and LTS version 2.27.7.
Vulnerability class: Information Disclosure
EPSS: 0.004 (29.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Portainer — versions < 2.27.7, < 2.31.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-49593?
- CVE-2025-49593 is a medium-severity vulnerability in Portainer, classified under Information Disclosure. CVSS score: 6.8/10. Published 2025-06-17.
- How severe is CVE-2025-49593?
- Medium severity. CVSS v3 base score is 6.8 out of 10.