Live › vulnerability › CVE-2024-29296
Go to dashboardPortainer CE's login endpoint responds at a measurably different speed for valid and invalid usernames. An unauthenticated remote attacker can use that timing difference to find which usernames exist, which helps them target password guessing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| github.com/portainer/portainer | go | < 0.6.1-0.20240417040827-48bc7d0d92f0 | 0.6.1-0.20240417040827-48bc7d0d92f0 |
Unknown from the sources.
Upgrade the github.com/portainer/portainer module to 0.6.1-0.20240417040827-48bc7d0d92f0 or later, or upgrade Portainer CE past 2.19.4 (the sources do not name the exact Portainer CE release).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A user enumeration vulnerability was found in Portainer CE 2.19.4. This issue occurs during user authentication process, where a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not.
This page as .md · .json · in your agent: get_signal("CVE-2024-29296")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.