All vulnerabilities
CVE-2024-29296GHSA-87x6-8m9v-g8c2GO-2026-6619

github.com/portainer/portainer: Portainer CE allows username enumeration through authentication response timing

n/a github.com/portainer/portainergoApplications & CMS
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)1.25%Chance of exploitation activity in the next 30 days, higher than 69% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.6.1-0.20240417040827-48bc7d0d92f0Fixed versionGitHub
Published10 Apr 2024Updated 1 Oct 2026CVE List

What fixes it

  • 0.6.1-0.20240417040827-48bc7d0d92f0github.com/portainer/portainer, goGitHubgo get github.com/portainer/portainer@v0.6.1-0.20240417040827-48bc7d0d92f0
  • 0.6.1-0.20240417040827-48bc7d0d92f0github.com/portainer/portainer, GoOSVgo get github.com/portainer/portainer@v0.6.1-0.20240417040827-48bc7d0d92f0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A user enumeration vulnerability was found in Portainer CE 2.19.4. This issue occurs during user authentication process, where a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not.

Text from CVE List

Affected versions 3

  • github.com/portainer/portainer, go< 0.6.1-0.20240417040827-48bc7d0d92f0GitHub
  • n/aaffected: n/aCVE List
  • github.com/portainer/portainer, Gofrom first release, fixed in 0.6.1-0.20240417040827-48bc7d0d92f0OSV

References 8