PORTAINER has fixed two critical vulnerabilities, both rated CVSS 9.4, that could let standard users mount files from the Docker host into containers. The flaws could lead to root access on the host. One reportedly extends a bind-mount bypass that remained after two earlier fixes, CVE-2026-44849 and CVE-2026-44850. The supplied report does not give the new vulnerabilities’ CVE identifiers or technical details, and does not say that either flaw has been exploited.
The fixes are included in Portainer 2.45.2. Organisations using Portainer should update to that version to address both issues.