CVE-2024-29296
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
A user enumeration vulnerability was found in Portainer CE 2.19.4. During the authentication process, a difference in response time allows a remote unauthenticated attacker to determine if a username is valid.
Risk Assessment
The risk is that an attacker can compile a list of valid usernames, facilitating targeted brute-force or social engineering attacks against the Portainer system.
Recommendation
It is recommended to upgrade Portainer CE to the latest available version that fixes this vulnerability. Until then, consider restricting access to the Portainer interface to trusted networks only.
Other vulnerabilities in Portainer CE
See all- CVE-2026-72533High
An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoint fails to normalize request paths before applying access controls, allowing crafted requests to be interpreted differently by the proxy and the authorization layer.
- CVE-2026-33590High
The insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code execution. An authenticated non-administrative user with endpoint access can exploit these settings to read host files or obtain root equivalent access on the host.
Original NVD description (English source)
A user enumeration vulnerability was found in Portainer CE 2.19.4. This issue occurs during user authentication process, where a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS