LoginSign Up
← Back to all sparks
P

Portainer

INFRA · APIS
Velocity5.0

Open-source container management platform for Docker, Kubernetes, and edge environments

www.portainer.io ↗

Portainer 2.45.3 drops trust in eMudhra certificates and scopes kubeconfig tokens per environment.

container-managementkubernetessecurityaccess-controllts
◆Current state
Portainer 2.45.3 LTS stops trusting eMudhra emSign certificates after the compromise of eight intermediates, which can break SSO, LDAPS, registry and Git connections that use them. It also limits downloaded kubeconfig tokens to one environment's Kubernetes proxy, blocks a volumes_from route around hidden bind mounts, and patches a batch of critical Go and Helm CVEs.
◆Where it's heading
Every release in the 2.45 line has closed another way for non-admins or tokens to reach beyond their scope: the Docker proxy bypass, SSRF, bind-mount escapes, and now kubeconfig tokens. Native Kubernetes APIs from 2.45.0 make that tightening possible, and GitOps polling keeps getting reliability fixes alongside.
◆Prediction
Expect a 2.39 LTS backport of the eMudhra and kubeconfig changes, and further token and permission scoping in the next 2.45 patch.

◆Recent moves

  1. 7d ago

    Portainer 2.45.3 distrusts eMudhra CAs, scopes kubeconfig tokens

    The fourth security-led release of the 2.45 line distrusts the compromised eMudhra CAs, a breaking change for affected SSO and registry setups, and limits kubeconfig tokens to a single environment's Kubernetes proxy. GitOps poll overlap and several agent permission bugs are fixed too.

    View source ↗
  2. 21d ago

    Portainer 2.45.2: bind-mount bypass closed, K8s node-pool columns

    The third authorization fix in three releases: non-admin Compose files can no longer reach host files outside the stack directory, and in-cluster TLS verification is no longer skipped. A new node-group column for EKS, GKE, AKS, Karpenter and kops pools extends the 2.45 Kubernetes-management push into cloud node pools.

    View source ↗
  3. 1mo ago

    Portainer 2.45.1: SSRF transport hardened across all outbound operations

    This patch extends the SSRF-aware transport introduced in 2.45.0 to cover Helm chart resolution and Git HTTP/HTTPS operations, and tightens enforcement so an aliased import can no longer slip past the check. Multiple critical CVEs in the kubectl shell image are cleared, including two rated Critical (CVE-2026-63073 and CVE-2026-75803), plus nine High and eleven Medium findings.

    View source ↗
  4. 1mo ago

    Portainer 2.39.8: Go toolchain CVE maintenance backport

    A dependency-only maintenance release for the 2.39 LTS stream: Go toolchain bumped from 1.25.12 to 1.25.14, clearing the same CVE batch addressed in 2.45.1. One functional fix: the updater no longer marks a container healthy before its health-check command has completed, preventing a failed upgrade from silently skipping rollback.

    View source ↗
  5. 2mo ago

    Portainer 2.45.0: native K8s API surface debuts, Docker proxy auth bypass closed

    ⚡ SPARK

    The headline architectural move is replacing direct kube-apiserver proxy calls with native Portainer-owned APIs for secrets, configmaps, deployments, and PVCs. A critical Docker proxy authorization bypass — malformed version prefixes in the URL path skipped access control entirely — and a Kubernetes shell flaw where caller-supplied query params could override pod targets were both closed in the same release.

    View source ↗
  6. 2mo ago

    Portainer 2.39.7: Critical Docker proxy auth bypass backported to LTS

    A targeted security backport of the Docker proxy authorization bypass fix and broadened bind-mount restrictions from 2.45.0 into the 2.39 LTS stream, for operators unwilling to move to the 2.45 line. Two distinct authorization control gaps are addressed with no other changes — a narrowly scoped patch.

    View source ↗