Portainer 2.45.3: eMudhra CA distrust, clean upgrade

released
lab run
upgraded from
2.45.2
guest
Ubuntu 26.04 VM
tested
yes, in our lab

Summary

Portainer 2.45.3 is mostly a security release. It updates the Go toolchain to 1.26.10 and golang.org/x/net to 0.60.0, fixing two Critical CVEs (CVE-2026-56857, CVE-2026-78663) among others. It updates helm in the kubectl shell image to v4.3.1. It also blocks volumes_from in stacks created by non-admins when “Hide bind mounts for non-administrators” is on, and limits kubeconfig tokens to the Kubernetes proxy route for their own environment.

Bug fixes include container start with an empty request body on Docker standalone and Swarm agents, overlapping GitOps polls, GitOps status after a manual redeploy, and the search box on the Authentication logs page.

Breaking changes and deprecations

Reported in the release notes: Portainer no longer trusts TLS certificates issued by eMudhra (emSign), after the compromise of eight eMudhra intermediate CAs (CVE-2026-111943). Connections to OAuth/OIDC, LDAPS, registries or Git hosts that present an affected certificate will fail. If your SSO or LDAP provider is affected, only the initial admin can sign in. The release notes link an FAQ.

Kubeconfigs downloaded after the upgrade carry a separate token per environment, and tokens are rejected with 403 outside the Kubernetes proxy route.

No deprecated or removed features are listed.

Tested in our lab

Tested in our lab: a fresh Docker install of Portainer CE 2.45.2, then an upgrade to 2.45.3 by stopping and removing the container and starting the new image on the same data volume.

  • Before: the API reported 2.45.2. We created the admin user and added the local Docker environment.
  • After: the API reported 2.45.3 with the same instance ID, the web UI answered HTTP 200, the admin could still log in, and the “local” environment was still there. A search of the container log for error or warning lines found none.
  • Note: a new install now needs a setup token (printed in the container log) in an X-Setup-Token header or on the setup screen before the admin can be created.

We did not test the eMudhra distrust, SSO/LDAP, Kubernetes, Edge, GitOps or Podman. Those changes are not covered by this result.

Lab log

$ docker run -d -p 9443:9443 --name portainer --restart=always -v /var/run/docker.sock:/var/run/docker.sock -v portainer_data:/data portainer/portainer-ce:2.45.2
$ curl -sk https://localhost:9443/api/system/status
{"Version":"2.45.2","InstanceID":"19f68699-40a8-4867-b473-02508941b8df"}
$ docker stop portainer && docker rm portainer
$ docker run -d -p 9443:9443 --name portainer --restart=always -v /var/run/docker.sock:/var/run/docker.sock -v portainer_data:/data portainer/portainer-ce:2.45.3
$ curl -sk https://localhost:9443/api/system/status
{"Version":"2.45.3","InstanceID":"19f68699-40a8-4867-b473-02508941b8df"}
$ curl -sk https://localhost:9443/api/endpoints -H "Authorization: Bearer [redacted]" | grep -o "\"Name\":\"local\""
"Name":"local"
$ curl -sk -o /dev/null -w "%{http_code}\n" https://localhost:9443/
200

Reported by others

Nothing beyond the release notes. Known issues listed there: an invalid update schedule date can show when browsing a snapshot on Async Edge environments, and Podman support has limits (CentOS 9, Podman 5 rootful only).

Verdict

Upgrade soon. Our simple Docker upgrade was clean. Before you upgrade, check whether your OIDC, LDAPS, registry or Git hosts use eMudhra certificates. If they do, sort that out first, or you may be locked out except for the initial admin.

sources