---
id: "CVE-2024-29296"
kind: "vulnerability"
aliases: ["CVE-2024-29296", "GHSA-87x6-8m9v-g8c2", "GO-2026-6619"]
title: "Portainer CE allows username enumeration through authentication response timing in github.com/portainer/portainer"
severity: "medium"
cvss: 5.3
epss: 0.01252
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/portainer/portainer", "fixed": ["0.6.1-0.20240417040827-48bc7d0d92f0"], "affected": "< 0.6.1-0.20240417040827-48bc7d0d92f0", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "package", "portainer", "self-hosted"]
not_affected_if: ["auth-required"]
published_at: "2024-04-10T15:16:05+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:49:02+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6619", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-29296", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29296", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Portainer CE allows username enumeration through authentication response timing in github.com/portainer/portainer

Portainer CE's login endpoint responds at a measurably different speed for valid and invalid usernames. An unauthenticated remote attacker can use that timing difference to find which usernames exist, which helps them target password guessing.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/portainer/portainer affected < 0.6.1-0.20240417040827-48bc7d0d92f0 fixed 0.6.1-0.20240417040827-48bc7d0d92f0

## Fix

Upgrade the github.com/portainer/portainer module to 0.6.1-0.20240417040827-48bc7d0d92f0 or later, or upgrade Portainer CE past 2.19.4 (the sources do not name the exact Portainer CE release).

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6619
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2024-29296
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-29296

## From the sources

A user enumeration vulnerability was found in Portainer CE 2.19.4. This issue occurs during user authentication process, where a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_