CVE-2026-44883 | portainer Community Edition up to 2.33.7/2.39.1/2.40.x get request method with sensitive query strings (GHSA-jvp4-q659-95mj)

Portainer Community Edition versions prior to 2.33.8, 2.39.2, and 2.41.0 contain CVE-2026-44883: the application accepts JWT bearer tokens passed in the ?token= URL query parameter on authenticated API endpoints (used by browser-based attach/exec/shell features), which can be recorded in reverse-proxy logs, browser history, or Referer headers and harvested to gain full user privileges; the issue is remotely exploitable with authentication and user interaction required, no public exploit is reported, and upgrading to the fixed versions mitigates the vulnerability.