Portainer CE allows username enumeration through authentication response timing

MEDIUM 5.3CVE-2024-29296 · GHSA-87x6-8m9v-g8c2 · GO-2026-6619 · Published 10/04/2024 · updated 09/07/2026

In short

CVE-2024-29296 is a MEDIUM (CVSS 5.3) vulnerability affecting github.com/portainer/portainer, portainer (portainer).
Chance of exploitation in the next 30 days (EPSS): 1.3%, higher than 69.5% of all vulnerabilities.
Fix: update to 0.6.1-0.20240417040827-48bc7d0d92f0 or later.

Package	Affected versions	Patched versions
github.com/portainer/portainer Go	`< 0.6.1-0.20240417040827-48bc7d0d92f0`	`0.6.1-0.20240417040827-48bc7d0d92f0`
portainer portainer	`= 2.19.4`	No fix yet

Description

A user enumeration vulnerability was found in Portainer CE 2.19.4. This issue occurs during user authentication process, where a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2024-29296 · ADVISORY
portainer/portainer · WEB
portainer/portainer#11589 · WEB
portainer/portainer commit 48bc7d0 · WEB
ThaySolis/CVE-2024-29296 · WEB
portainer/portainer · PACKAGE
portainer/portainer release 2.19.5 · WEB
portainer/portainer release 2.20.2 · WEB
GitHub Advisory GHSA-87x6-8m9v-g8c2 · ADVISORY

More vulnerabilities in github.com/portainer/portainer

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/portainer/portainer

< 0.6.1-0.20240417040827-48bc7d0d92f0

0.6.1-0.20240417040827-48bc7d0d92f0

portainer

= 2.19.4

No fix yet

Description

NVD description

More vulnerabilities in github.com/portainer/portainer

See all →