Portainer: JWT accepted in URL query leaks tokens to logs and referers

None of these replace the fix.

Affected Code

Pre-fix, extractBearerToken in api/http/security/bouncer.go read the JWT from the token query parameter before falling back to the Authorization header. The query.Del("token") call scrubs the parameter from r.URL.RawQuery on the way through Portainer, but by that point the original URL has already been recorded by any upstream reverse proxy, access logger, or browser.

func extractBearerToken(r *http.Request) (string, bool) {
    query := r.URL.Query()
    token := query.Get("token")
    if token != "" {
        query.Del("token")
        r.URL.RawQuery = query.Encode()
        return token, true
    }

    tokens, ok := r.Header[jwtTokenHeader]
    if !ok || len(tokens) == 0 {
        return "", false
    }
    // ...
}

The fix removes the query-parameter path entirely. Authenticated requests now carry the JWT via the Authorization header for API clients, or via the portainer_api_key HttpOnly cookie for the browser UI — cookies are sent automatically on same-origin WebSocket upgrade requests, so the browser-based container attach, exec, and pod shell features continue to work without exposing the token in the URL. The WebSocket handlers that previously documented ?token= as a required query parameter have been updated to match.

Impact

• Token leakage to infrastructure. Intermediate systems that observe the request URL — reverse proxies, load balancers, access logs, WAFs, and corporate network monitoring — capture the full JWT in plaintext.
• Token leakage via the browser. URLs containing ?token= are recorded in browser history and forwarded in the Referer header on any outbound navigation from the Portainer UI.
• Account takeover. Anyone with access to a leaked JWT acts as the authenticated user for the remainder of the token's validity, without needing the password. If the leaked token belongs to an administrator, the attacker gains full API access including user management, container exec, and stack deployment.
• Reach beyond Portainer. Container exec with an administrator JWT reaches the host filesystem of managed environments and can be used to execute commands on those hosts.

Timeline

• 2026-03-06: Reported via GitHub Security Advisory by scanpwn.
• 2026-04-14: Fix merged to develop.
• 2026-04-29: 2.41.0 released.
• 2026-05-07: 2.39.2-LTS and 2.33.8-LTS released.

Credit

• scanpwn — identified and reported the query-parameter JWT acceptance and the resulting token-leakage vectors.