## https://sploitus.com/exploit?id=109DCEB3-DE61-5471-8DDB-A813D9ABF3FE
# CVE-2026-44848 — Portainer: Missing Authorization on Docker Plugin Endpoints → Host RCE
Proof-of-concept for **CVE-2026-44848**, a missing-authentication (CWE-862) vulnerability
in [Portainer](https://github.com/portainer/portainer) that lets a **non-admin** user with
Docker endpoint access perform privileged Docker plugin operations → full **host RCE**.
GitHub Security Advisory: **GHSA-rrmm-9v76-h3p4** · CVSS 9.4 (Critical).
## Root cause
Portainer enforces Role-Based Access Control (RBAC) on top of the Docker API by proxying
requests through per-resource handlers that apply authorization checks. The Docker
**plugin management** endpoints (`/plugins/*`) were **not registered with a handler**, so
the authorization layer never runs for them. As a result, a Standard User (Role 2) — or any
role granted endpoint-level access — can call privileged plugin operations directly against
the underlying Docker daemon:
- `POST /plugins/pull` — pull an arbitrary plugin from any registry
- plugin requests privileges including `CAP_SYS_ADMIN` and host-path mounts
- `POST /plugins/{name}/enable` — Docker runs the plugin **as root on the host** with those
capabilities → full host filesystem access and equivalent to root on the Docker host
## Affected versions
- `>= 2.33.0, = 2.39.0, = 2.40.0, PASS (missing auth / host-RCE primitive confirmed)
```
## References
- [GHSA-rrmm-9v76-h3p4](https://github.com/advisories/GHSA-rrmm-9v76-h3p4)
- [CVE-2026-44848 (NVD/cvefeed)](https://cvefeed.io/vuln/detail/CVE-2026-44848)
## Disclaimer
For authorized security research and testing only. The enabling step (`POST /plugins/*`)
can grant root on the host; this PoC stops at demonstrating the authorization bypass and
does not enable a destructive/malicious plugin. Use only against systems you own or are
authorized to test.