CVE-2024-29296: Portainer User Enumeration Vulnerability

CVE-2024-29296 Overview

CVE-2024-29296 is a user enumeration vulnerability in Portainer Community Edition (CE) version 2.19.4. The flaw resides in the authentication workflow, where response times differ measurably between valid and invalid usernames. A remote unauthenticated attacker can measure these timing differences to determine which usernames exist in the system. The issue is classified under [CWE-286] (Incorrect User Management) and affects a widely deployed container management platform used to administer Docker, Kubernetes, and Swarm environments.

Critical Impact
Unauthenticated remote attackers can enumerate valid Portainer usernames by comparing authentication response times, enabling targeted credential attacks against confirmed accounts.

Affected Products

Portainer Community Edition (CE) 2.19.4
Deployments exposing the Portainer web interface or API to untrusted networks
Container management stacks relying on Portainer for Docker, Kubernetes, or Swarm orchestration

Discovery Timeline

2024-04-10 - CVE-2024-29296 published to the National Vulnerability Database
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2024-29296

Vulnerability Analysis

The vulnerability is a side-channel information disclosure flaw in Portainer CE 2.19.4's login handler. When a client submits credentials, the server processes valid and invalid usernames along different code paths. Valid usernames trigger password hashing and comparison operations, while invalid usernames often short-circuit before these expensive cryptographic checks. This produces a measurable timing difference in the HTTP response.

An attacker can automate login requests using arbitrary usernames and record the response latency for each. Statistically significant timing gaps reveal which accounts exist. The impact is limited to confidentiality of account existence, but enumerated usernames materially improve the success rate of downstream password spraying, brute-force, and phishing campaigns. Public proof-of-concept code exists in the ThaySolis GitHub repository, lowering the barrier for opportunistic scanning.

Root Cause

The root cause is non-constant-time handling of authentication requests. Portainer's login flow performs bcrypt-style password verification only when the submitted username maps to an existing account. When the username does not exist, the request returns quickly without executing the hashing routine. This deviation from constant-time authentication design ([CWE-286]) leaks the account existence state through observable timing.

Attack Vector

The attack is network-based and requires no authentication, privileges, or user interaction. An attacker sends repeated POST requests to the Portainer authentication endpoint using candidate usernames from a wordlist and a fixed dummy password. The client records the elapsed time between request and response for each attempt. Requests that take noticeably longer indicate valid accounts, as the server performed a full password hash comparison. After compiling a list of valid usernames, the attacker can pivot to credential stuffing or targeted brute-force attacks against those specific accounts.

The vulnerability manifests as a timing side channel in the login handler. Refer to the public proof-of-concept for technical demonstration of the measurement methodology.

Detection Methods for CVE-2024-29296

Indicators of Compromise

High volumes of failed login attempts from a single source IP against the Portainer authentication endpoint
Sequential login attempts iterating through common or dictionary-based usernames within short intervals
Requests with identical or placeholder passwords across many different usernames
Unusual burst traffic patterns to /api/auth or equivalent Portainer login routes

Detection Strategies

Enable verbose authentication logging on Portainer and forward events to a centralized logging platform for correlation
Baseline normal login volume per source IP and alert on statistical deviations indicating automated enumeration
Deploy a web application firewall rule to rate-limit authentication requests and flag repeated failures
Correlate failed authentication events with subsequent successful logins to identify enumeration followed by credential attacks

Monitoring Recommendations

Track authentication endpoint request rates and alert when thresholds exceed operational baselines
Monitor for user-agent strings associated with automated scanning tools targeting the Portainer API
Review network flow data for external hosts making sustained connections to Portainer management ports
Audit Portainer user account lists periodically and remove stale or unused accounts to shrink the enumeration surface

How to Mitigate CVE-2024-29296

Immediate Actions Required

Upgrade Portainer CE from 2.19.4 to the latest patched release available from the vendor
Restrict network access to the Portainer web interface using firewall rules, VPN, or reverse proxy allowlists
Enforce strong, unique passwords and enable multi-factor authentication for all Portainer accounts
Rate-limit authentication requests at the reverse proxy or web application firewall layer

Patch Information

Upgrade to a Portainer CE release later than 2.19.4 that addresses the timing discrepancy in the authentication handler. Consult the Portainer release notes for the specific patched version and verify the fix through post-upgrade timing tests. No vendor advisory URL is currently included in the NVD record for this CVE.

Workarounds

Place Portainer behind an authenticating reverse proxy that terminates unauthenticated traffic before it reaches the login endpoint
Implement source-IP allowlisting so only trusted administrative networks can reach the Portainer management interface
Configure aggressive rate limiting and account lockout thresholds to slow automated enumeration attempts
Deploy fail2ban or an equivalent tool to temporarily block source IPs that generate repeated failed authentications

bash

# Example nginx reverse proxy configuration to rate-limit Portainer login attempts
http {
    limit_req_zone $binary_remote_addr zone=portainer_auth:10m rate=5r/m;

    server {
        listen 443 ssl;
        server_name portainer.example.com;

        location /api/auth {
            limit_req zone=portainer_auth burst=5 nodelay;
            limit_req_status 429;
            proxy_pass http://portainer_backend;
        }

        location / {
            allow 10.0.0.0/8;
            deny all;
            proxy_pass http://portainer_backend;
        }
    }
}