Vulnerability Reportportainer/portainer-ce:2.39.8-alpine

portainer/portainer-ce:2.39.8-alpine

digestsha256:a0d04c9826efe13402e561589cbdf532d669671f62e40cc02dcd0b5211e4a9a5

Executive Summary

Last scanned: Nov 2, 2026

Threat ScoreCAUTION• CVE-2026-78669 in golang.org/x/net (v0.57.0) lets a remote client flood the web server with crafted HTTP/2 SETTINGS frames, which can drive up CPU use and stall the Portainer web interface that is reachable from the network in normal operation.• The scan found 5 flaws rated 7.0 or higher and 9 rated 6.0 or higher among exposed components, with the highest severity at 7.5; none are listed as known to be actively exploited.• CVE-2026-78659 and CVE-2026-94440 affect the Go HTTP/2 and multipart form handling used by the exposed ports, where crafted requests can exhaust memory and make the Portainer UI and API unavailable.• The findings are denial-of-service impacts rather than code execution or data theft, which limits the direct damage an outside attacker could cause.• The publisher is rated TRUSTED and the image is pinned by digest, which supports provenance but does not remove the vulnerable Go libraries inside the image.• The image runs as root by default, which increases the impact of any later compromise even though the top findings do not show that path directly.

59/100CAUTION

ReputationVERIFIED• Verified Publisher (Trusted Vendor)• Pinned by digest (Immutable)

TRUSTED

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker who can reach the exposed web ports could send crafted HTTP/2 or multipart requests, for example via CVE-2026-78669 or CVE-2026-94440, to exhaust CPU or memory and make Portainer's management interface unavailable. Because Portainer manages container infrastructure, even a short outage can disrupt operations, so the exposed ports should be restricted to trusted networks and the Go dependencies updated before production use.

Hardening plan for this image · 5 steps

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

72 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-78669	HIGH7.5	golang.org/x/net v0.57.0 fixed in 0.60.0	0.6% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-78659	HIGH7.5	golang.org/x/net v0.57.0 fixed in 0.60.0	0.6% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-78669	HIGH7.5	stdlib v1.25.14 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-78659	HIGH7.5	stdlib v1.25.14 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-94440	HIGH7.5	stdlib v1.25.14 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-17106	MEDIUM6.24	github.com/moby/go-archive v0.1.0 fixed in 0.3.0	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78660	MEDIUM6	golang.org/x/net v0.57.0 fixed in 0.60.0	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78667	MEDIUM6	stdlib v1.25.14 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78660	MEDIUM6	stdlib v1.25.14 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-63073	MEDIUM5.9	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	1.2% Low-Moderate Risk	Directly Exposed
CVE-2026-63073	MEDIUM5.9	libssl3 3.5.7-r0 fixed in 3.5.8-r0	1.2% Low-Moderate Risk	Directly Exposed
CVE-2026-97032	MEDIUM5.9	golang.org/x/net v0.57.0 fixed in 0.60.0	0.5% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-97032	MEDIUM5.9	stdlib v1.25.14 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly Exposed
CVE-2026-33747	MEDIUM5.88	github.com/moby/buildkit v0.25.1 fixed in 0.28.1	0.5% Theoretical Threat	Directly Exposed
CVE-2026-61801	MEDIUM5.5	github.com/moby/sys/user v0.4.0 fixed in 0.4.1	0.1% Theoretical Threat	Directly Exposed
CVE-2026-85747	MEDIUM5.44	github.com/docker/distribution v2.8.3+incompatible No fix yet	0.2% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-111943	MEDIUM5.44	stdlib v1.25.14 fixed in 1.26.10, 1.27.3	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78663	MEDIUM5.3	golang.org/x/net v0.57.0 fixed in 0.60.0	0.6% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-78663	MEDIUM5.3	stdlib v1.25.14 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly Exposed
CVE-2026-94439	MEDIUM5.2	stdlib v1.25.14 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-85091	MEDIUM5	zlib 1.3.2-r0 fixed in 1.3.2-r1	0.5% Theoretical Threat	Directly Exposed
CVE-2026-95837	MEDIUM4.68	github.com/containerd/containerd/v2 v2.2.5 fixed in 2.2.7, 2.3.4	0.1% Theoretical Threat	Directly Exposed
CVE-2026-14456	MEDIUM4.5	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.7% Theoretical Threat	Directly Exposed
CVE-2026-18798	MEDIUM4.5	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	1.7% Low-Moderate Risk	Directly Exposed
CVE-2026-63072	MEDIUM4.5	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.9% Theoretical Threat	Directly Exposed
CVE-2026-63076	MEDIUM4.5	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	1.6% Low-Moderate Risk	Directly Exposed
CVE-2026-14457	MEDIUM4.5	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	1.2% Low-Moderate Risk	Directly Exposed
CVE-2026-54874	MEDIUM4.5	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-63074	MEDIUM4.5	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-63075	MEDIUM4.5	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-14456	MEDIUM4.5	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.7% Theoretical Threat	Directly Exposed
CVE-2026-18798	MEDIUM4.5	libssl3 3.5.7-r0 fixed in 3.5.8-r0	1.7% Low-Moderate Risk	Directly Exposed
CVE-2026-63072	MEDIUM4.5	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.9% Theoretical Threat	Directly Exposed
CVE-2026-63076	MEDIUM4.5	libssl3 3.5.7-r0 fixed in 3.5.8-r0	1.6% Low-Moderate Risk	Directly Exposed
CVE-2026-14457	MEDIUM4.5	libssl3 3.5.7-r0 fixed in 3.5.8-r0	1.2% Low-Moderate Risk	Directly Exposed
CVE-2026-54874	MEDIUM4.5	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-63074	MEDIUM4.5	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-63075	MEDIUM4.5	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-33748	MEDIUM4.5	github.com/moby/buildkit v0.25.1 fixed in 0.28.1	0.5% Theoretical Threat	Directly Exposed
CVE-2026-97031	MEDIUM4.5	stdlib v1.25.14 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly Exposed
CVE-2026-107891	MEDIUM4	musl 1.2.6-r2 fixed in 1.2.6-r3	—	Directly Exposed
CVE-2026-107891	MEDIUM4	musl-utils 1.2.6-r2 fixed in 1.2.6-r3	—	Directly Exposed
CVE-2025-47909	LOW3.91	github.com/gorilla/csrf v1.7.3 No fix yet	0.2% Theoretical Threat	Directly Exposed
CVE-2026-56866	LOW3.9	stdlib v1.25.14 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly Exposed
CVE-2026-61711	LOW3.78	github.com/moby/buildkit v0.25.1 fixed in 0.31.1	0.4% Theoretical Threat	Directly Exposed
CVE-2026-75803	LOW3.7	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-75803	LOW3.7	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-94448	LOW3.66	stdlib v1.25.14 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Directly Exposed
CVE-2026-97030	LOW3.66	stdlib v1.25.14 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Directly Exposed
CVE-2026-53495	LOW3.3	github.com/containerd/containerd/v2 v2.2.5 fixed in 2.0.12, 2.2.8, 2.3.5	0.2% Theoretical Threat	Directly Exposed
CVE-2026-61712	LOW3.3	github.com/moby/buildkit v0.25.1 fixed in 0.31.1	0.4% Theoretical Threat	Directly Exposed
CVE-2026-81870	LOW3.3	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 fixed in 1.45.0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-81870	LOW3.3	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0 fixed in 1.45.0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-81870	LOW3.3	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 fixed in 1.45.0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-81870	LOW3.3	go.opentelemetry.io/otel/sdk v1.43.0 fixed in 1.45.0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-56857	LOW3.3	stdlib v1.25.14 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly Exposed
CVE-2026-53493	LOW3.18	github.com/containerd/containerd/v2 v2.2.5 fixed in 2.0.13, 2.2.9, 2.3.6, 2.4.1	0.4% Theoretical Threat	Directly Exposed
CVE-2026-33997	LOW2.92	github.com/docker/docker v28.5.1+incompatible fixed in 29.3.1	0.4% Theoretical Threat	Post-Exploit
CVE-2025-15558	LOW2.88	github.com/docker/cli v28.5.1+incompatible fixed in 29.2.0	0.5% Theoretical Threat	Post-Exploit
CVE-2026-84304	LOW2.7	google.golang.org/grpc v1.82.1 fixed in 1.83.1	0.6% Theoretical Threat	Post-Exploit
CVE-2026-84445	LOW2.7	google.golang.org/grpc v1.82.1 fixed in 1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e	0.6% Theoretical Threat	Post-Exploit
CVE-2026-41567	LOW2.59	github.com/docker/docker v28.5.1+incompatible No fix yet	0.2% Theoretical Threat	Post-Exploit
CVE-2026-42306	LOW2.59	github.com/docker/docker v28.5.1+incompatible No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-84303	LOW2.27	google.golang.org/grpc v1.82.1 fixed in 1.83.1	0.3% Theoretical Threat	Post-Exploit
CVE-2026-41568	LOW2.16	github.com/docker/docker v28.5.1+incompatible No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-53495	LOW1.98	github.com/containerd/containerd v1.7.33 fixed in 1.7.35	0.2% Theoretical Threat	Post-Exploit
CVE-2026-95838	LOW1.98	github.com/containerd/containerd/v2 v2.2.5 fixed in 2.0.12, 2.2.8, 2.3.5	0.2% Theoretical Threat	Directly Exposed
CVE-2026-53493	LOW1.91	github.com/containerd/containerd v1.7.33 fixed in 1.7.36	0.4% Theoretical Threat	Post-Exploit
CVE-2026-56855	LOW1.91	golang.org/x/crypto v0.55.0 fixed in 0.56.0	0.5% Theoretical Threat	Post-Exploit
CVE-2026-78662	LOW1.91	golang.org/x/crypto v0.55.0 fixed in 0.56.0	0.4% Theoretical Threat	Post-Exploit
GO-2026-5932	LOW1.44	golang.org/x/crypto v0.55.0 No fix yet	—	Post-Exploit
CVE-2026-95838	LOW1.19	github.com/containerd/containerd v1.7.33 fixed in 1.7.35	0.2% Theoretical Threat	Post-Exploit

Want to check another image? Run a full scan with the Docker Security Scanner.