{"action":"Upgrade github.com/portainer/portainer to 2.39.4 or later.","affected":[{"fixed":"2.39.4","introduced":"2.39.0"},{"fixed":"2.43.0","introduced":"2.40.0"}],"component":"github.com/portainer/portainer","cve_ids":["CVE-2026-55761"],"ecosystem":"Go","epss":0.00493,"exploited":false,"fixed_versions":["2.39.4","2.43.0"],"ghsa_id":"GHSA-x626-fcwx-f5pc","id":"tcs_01M5KFRNCST85Z2NN49J4H98XF","modified_at":"2026-09-02T19:55:44.937680570Z","published_at":"2026-08-28T20:28:19Z","references":["https://osv.dev/vulnerability/GHSA-x626-fcwx-f5pc","https://github.com/portainer/portainer/security/advisories/GHSA-x626-fcwx-f5pc","https://nvd.nist.gov/vuln/detail/CVE-2026-55761","https://github.com/portainer/portainer/issues/2770","https://github.com/portainer/portainer/commit/49f19107cf9a3540cbe406c9eb7f24390e1af02b","https://github.com/portainer/portainer/commit/d2b56efcb4e43c4168bb6688eee9f6bf22867312","https://github.com/portainer/portainer","https://github.com/portainer/portainer/releases/tag/2.39.4","https://github.com/portainer/portainer/releases/tag/2.43.0"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-x626-fcwx-f5pc","url":"https://osv.dev/vulnerability/GHSA-x626-fcwx-f5pc"}],"summary":"Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instances"}