Portainer

Known issues

• On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot

Known issues with Podman support

• Podman environments aren't supported by auto-onboarding script
• It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
• Support for only CentOS 9, Podman 5 rootful

Changes

New and improved features

• Added a basic workflow details screen
• Added GPU visibility in the Environment Details view
• Made the Portainer setup token easier to spot in the installation logs
• Tracked the Source, Workflow, and Artifact status persistently
• Upgraded bbolt to v1.5.0 for performance and robustness improvements
• Moved the build pipeline to BuildKit v0.31.2 (previously v0.27.0); image build provenance attestations moved to the SLSA v1.0 format (previously v0.2) — any tooling that parses attestations needed to be verified against the new format

Security improvements

• Fixed unauthorized access via leftover service accounts
• Fixed path traversal in the swarm compose deployer, where configs/secrets file paths escaped the project root
• CVE remediation:
  • Upgraded oras.land/oras-go/v2 to 2.6.1 to remediate CVEs
  • Upgraded containerd to 1.7.33 / v2 2.2.5 to remediate CVEs
  • Upgraded google.golang.org/grpc to 1.82.1 to remediate GHSA-hrxh-6v49-42gf
  • Upgraded axios to 1.18.0 to remediate CVEs
  • Upgraded shell-quote to 1.8.4 to remediate CVEs

Bug fixes

• Fixed the "This node is not a swarm manager" error message when running inside a swarm
• Fixed image builds failing to authenticate against private registries in FROM lines by allowing the X-Registry-Config header through the proxy
• Fixed a team with valid access not appearing in Config access control while another team with identical access was visible
• Fixed AD/LDAP settings defects where special characters were stripped, the username format selection was invisible, the root domain was unpopulated, and the delete button was broken
• Fixed an issue where [object Object] appeared as an element name on the Alerting page
• Fixed a problem that caused sources to fail to load
• Brought back shared Git credentials for GitOps Sources
• Fixed an issue where a space-delimited list of scopes wasn't correctly requesting access to resources on the user's behalf, so the Google consent screen didn't show the expected permissions
• Fixed the poll frequency selection dropdown staying on the default value
• Fixed RBAC policy's datatable namespace input
• Fixed the forced polling usage in Git sources
• Fixed Helm chart uninstall showing cosmetic errors only
• Fixed the tooltip rendering for environment variables in Portainer Application Templates
• Fixed the Ingress service port number being displayed as 0 instead of the configured value
• Fixed Kubernetes manifest deployments reporting success but silently failing when "Use namespace from manifest" was disabled
• Fixed an output mismatch in the Kubectl shell between BE and CE
• Fixed an issue where logout caused an infinite page reload
• Fixed a missing source in the list until refresh
• Fixed non-admin redeploy failing when numeric environment variables were quoted in a stack (invalid containerPort)
• Fixed Portainer STS 2.42.0 showing "1 Agent needs upgrading" when none did
• Fixed Docker stack deployments that exceeded the 15-minute timeout remaining stuck in the "Deploying" state and blocking further redeployments
• Fixed RBAC policies not creating RoleBindings for grants with no namespace list (e.g. Operator, Helpdesk)
• Fixed re-assigning an edge group to an edge stack bringing back old state
• Fixed a regression where relative env_file: in Git sub-directory stacks resolved from the project root instead of the compose file's directory
• Removed the hint box from the Applications page
• Fixed Swarm stack and service deployments reporting success despite image pull failures caused by insufficient disk space
• Fixed the issue where a standard user couldn't deploy a Git stack against an admin-created Source Improved edge tunnel resiliency over high-latency/lossy network links
• Fixed Swarm edge stacks with edge configs failing to deploy
• Fixed Swarm image deletion inconsistencies
• Fixed Swarm stack deployments failing to re-pull private Docker Hub images despite valid registry credentials
• Improved the containers list to show only the first three published ports inline, collapsing the rest into a "+N more" badge, so containers with many ports no longer broke the table layout
• Fixed a v2.43.0 migration related to stacks and sources
• Fixed incorrect WebSocket handler error messages
• Fixed dark mode styling issues on the Workflows page
• Fixed the way ListRefs ignored request context, causing "context deadline exceeded" on large repos
• Fixed SSRF protection ignoring Dialer timeouts

Deprecated and removed features

Deprecated features

None.

Removed features

None

Known issues

• On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot

Known issues with Podman support

• Podman environments aren't supported by auto-onboarding script
• It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
• Support for only CentOS 9, Podman 5 rootful

Changes

• Fixed a 2.39.4 regression where a relative env_file: in a Git stack whose compose file lives in a repository sub-directory was resolved against the project root instead of the compose file's own directory, deploying stacks with an empty environment or failing outright
• Improved Edge tunnel reliability over high-latency links (satellite/VSAT): the server no longer tears down a half-established tunnel on timeout, keep-alive and unlimited background retries were added on the agent, and the ping timeout was raised from 3s to 8s
• Fixed standard users not seeing all of their teams in access control selectors (e.g. when restricting access on a newly created Docker Config), caused by FilterUserTeams incorrectly dropping teams
• Fixed deleting images from the Swarm image list only removing them from a single node instead of every node they exist on
• Fixed a potential block where a Docker stack deployment exceeding the internal 15-minute timeout left the stack stuck in "Deploying" status, preventing further redeployments
• Fixed the environment details view always showing the default poll frequency for Edge environments instead of the saved value
• Upgraded the Alpine base image from 3.23.4 to 3.24.1 to address OS-level package CVEs, including the jq advisories (CVE-2026-32316, CVE-2026-40164 and others)
• Upgraded github.com/containerd/containerd/v2 to 2.2.5 to address the following CVEs:
  • CVE-2026-53488,
  • CVE-2026-53492,
  • CVE-2026-53489,
  • CVE-2026-47262,
  • CVE-2026-50195

Deprecated and removed features

Deprecated features

• None

Removed features

• None

Known issues

• On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot
• kubectl port-forward fails with Portainer kubeconfig in some configurations

Known issues with Podman support

• Podman environments aren't supported by auto-onboarding script
• It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
• Support for only CentOS 9, Podman 5 rootful

Changes

• Added an API endpoint to refresh Team/Group membership for a user
• Fixed an issue where users with no environment access are able to enumerate Kubernetes resources
• Fixed ecr token pre-validation error with warning log
• Fixed the way a standard user could not redeploy team stack or delete registry image
• Fixed the restore endpoint allowing admin takeover for uninitialised Portainer instances
• Fixed link on timed out page
• Replaced docker binary with libstack
• Fixed the volume label dropdown becoming blank
• Bump go-git to 5.19.1 to address the following CVEs:
  • CVE-2026-45570
  • CVE-2026-45571
  • GHSA-w5pp-99ch-qj29
• Bumped go stdlib to 1.25.11 to remediate the following stdlib CVEs:
  • CVE-2026-42504
  • CVE-2026-27145
  • CVE-2026-42499
  • CVE-2026-39836
  • CVE-2026-39820
  • CVE-2026-33814
  • CVE-2026-33811
  • CVE-2026-39826
  • CVE-2026-39823
  • CVE-2026-39825
  • CVE-2026-42504
  • CVE-2026-27145
  • CVE-2026-42507

Deprecated and removed features

Deprecated features

None

Removed features

None

Known issues

• On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot

Known issues with Podman support

• Podman environments aren't supported by auto-onboarding script
• It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
• Support for only CentOS 9, Podman 5 rootful

Changes

New and improved features

• GitOps Sources: new Source Creation wizard, Source Detail screen and Source editing, with reuse of existing sources when adding Docker repository stacks and Kubernetes Helm-from-git installs
• Display cached container images per node on Kubernetes
• In-product installation flow for KubeSolo-based single-node edge deployments
• Kubernetes application list and pod logs now default to expanded
• Environment Group Detail View updated with a new sortable-list-based group list UI

Security improvements

• Added a one-time setup token, printed to the server logs at startup, that is required to create the first administrator account or restore a backup on a new, uninitialised instance.
• Implemented an SSRF protection mechanism with a configurable allow-list in settings (off / audit / enforce modes)
• Added an endpoint authorization check to /api/kubernetes/{id}/* routes, preventing users with no access from enumerating Kubernetes resources
• Fixed custom-template user-access checks that bypassed the Resource Control definition, allowing edit/inspect/delete authorization to ignore admins-only / public / team grants
• Filter GET namespace results by the user's allowed-namespace list, returning Forbidden for namespaces the user cannot access
• Bumped golang.org/x/net to v0.55.0 for the following CVEs:
  • CVE-2026-39821, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-42502, CVE-2026-42506
• Bumped golang.org/x/crypto to v0.52.0 for the following CVEs:
  • CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-42508, CVE-2026-46595
• Bumped go.opentelemetry.io/otel to v1.43.0 for the following CVEs:
  • CVE-2026-39882, CVE-2026-39883
• Bumped github.com/go-git/go-git/v5 to v5.19.1 for the following CVEs:
  • CVE-2026-45571, GHSA-w5pp-99ch-qj29, CVE-2026-45570
• Bumped Go stdlib to 1.26.4 for the following CVEs:
  • CVE-2026-42504, CVE-2026-27145, CVE-2026-42507
• Bumped Go to 1.26.3 for the following CVEs:
  • CVE-2026-42499, CVE-2026-39836, CVE-2026-39820, CVE-2026-33814, CVE-2026-33811, CVE-2026-39826, CVE-2026-39823, CVE-2026-39825
• Bumped containerd to 1.7.32 and containerd/v2 to 2.2.4 for the following CVEs:
  • CVE-2026-46680
• Upgraded the kubectl-shell Helm SDK to helm/v4 4.1.4 for the following CVEs:
  • CVE-2026-35204, CVE-2026-35205

Bug fixes

• Fixed edge stacks that could not be deployed (Helm file-path cleared incorrectly)
• Fixed a ZodError (edgeStackId invalid input) when deploying an edge stack from a private repo to a group
• Fixed "Invalid option: expected one of 1|2" error for environments in the waiting room
• Fixed edge agent poll-handler timeouts and deadlocks; stale tunnels are now cleaned up immediately
• Fixed webhook POST returning 404 "Unable to find a webhook with this token" (webhook ID creation in the frontend)
• Fixed Git auto-update polling failures for regular stacks caused by a cancelled deployment context
• Standard users with access permission can again browse and delete private registry images (2.39.2 regression)
• Fixed a 500 error on stack deploy/update when an invalid ECR registry is present; ECR token pre-validation errors now log a warning instead
• Networks assigned to a Docker Swarm service at creation time are now correctly applied to the created service
• Restored YAML syntax highlighting in the web editor
• Improved performance of the image up-to-date status indicator; the UI no longer becomes slow/unresponsive on environments with many containers
• Replaced the agent's docker cp shell-out with the Docker SDK, removing the bundled docker binary; fixed directory archiving
• Pass proxy configuration through to the compose-unpacker container
• Now display a meaningful node count for Docker (non-swarm) on the home page
• Fixed environment up/down summary counts that were the wrong way round
• Fixed "Groups show No Environments" when environments are associated (Environment Groups detail breakdown regression)
• Removed a duplicate success notification on environment group update
• Environment group / home view UI bug fixes and environment-card consistency (long names wrap instead of overflowing)
• Unified Kubernetes application container actions as icon buttons with tooltip hover
• Improved the PVC deletion UX based on workload usage; fixed inability to delete unused Kubernetes volumes
• PVC list now hides system-namespace PersistentVolumeClaims unless "show system resources" is enabled
• Corrected the tooltip description for the pod-restart feature gate
• Made connectivity-test transport errors distinct from other errors (Linux error handling)
• Fixed table views missing horizontal margins
• Restored badge colors that were not visible in dark mode
• Fixed misalignment shown when an environment is down or has no containers

Deprecated and removed features

Deprecated features

None.

Removed features

• Provision KaaS Cluster feature

Known issues

• On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot

Known issues with Podman support

• Support for only CentOS 9, Podman 5 rootful
• Auto onboarding a Podman environment defaults to "Standard" and not "Podman"
• It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)

Changes

• Fixed a panic in Chisel
• Bumped in-toto-golang to 0.11.0 to address GHSA-pmwq-pjrm-6p5r
• Fixed a team access escalation via AuthorizedResourceControlUpdate logic flaw
• Fixed a full-read server-side request forgery (SSRF) vulnerability in the GitLab Registry Proxy endpoint that could be exploited via the X-Gitlab-Domain header
• Bumped github.com/go-git/go-git/v5 to 5.18.0 to address the following CVEs:
  • CVE-2026-34165
  • GHSA-3xc5-wrhm-f963
  • CVE-2026-33762
• Bumped golang.org/x/net to >= 0.53.0 to address the following CVEs:
  • CVE-2026-27141
  • CVE-2026-33814
• Fixed the "Re-pull image and redeploy" toggle
• Improved edge environment snapshot reliability by proactively triggering snapshots
• Bumped golang.org/x/crypto to 0.52.0 to address the following CVEs:
  • CVE-2026-39830
  • CVE-2026-39831
  • CVE-2026-39832
  • CVE-2026-39833
  • CVE-2026-39834
  • CVE-2026-42508
  • CVE-2026-46595
• Fixed a Git Auto Update polling failure for Stacks caused by improper shutdowns

Deprecated and removed features

None

Known issues

• On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot.

Known issues with Podman support

• Support for only CentOS 9, Podman 5 rootful.

Changes

Breaking changes

Changes to the CSRF protection implementation may cause failures when upgrading:

• Removal of legacy CSRF fallback (scheduled). The legacy-csrf feature flag, introduced in 2.41 as a temporary migration aid, has been removed as scheduled. Users still relying on this flag must resolve any CSRF configuration issues before upgrading (see the 2.41 breaking changes for details). This change also resolves CVE-2025-47909.

New and improved features

• Added theme selector to the user menu, allowing switching between light, dark, and high-contrast themes without navigating to settings.
• Added GitOps sources list view and source detail view for managing Git sources used in deployments.
• Added a connectivity test before adding edge environments.
• Added Docker host disk usage display to the host details view.
• Replaced Kubernetes Volume view with 3 new tables for PV, PVC, SC (PersistentVolumes, PersistentVolumeClaims, StorageClasses).
• Added link ability between Kubernetes secrets and service account image pull secrets for private registry access.
• Added pod restart and pod delete support on the Kubernetes application details page.
• Improved Application Container list, separated pod info from containers list.
• Ported Swarm stack deployments to use libstack, eliminating the embedded Docker binary from CE/BE images.
• Added support for volumes-only mount paths in the agent, enabling environments where Docker volumes are accessible via non-default mount paths.
• Added missing snapshot collection for Edge Agents with long running Chisel connections.

Security improvements

• Fixed Docker exec endpoint to enforce container resource controls, preventing unauthorized exec access to containers.
• Fixed Docker proxy to enforce resource controls on /containers/{id}/attach/ws WebSocket endpoint.
• Fixed URL path rewriting to clear the RawPath field, preventing path traversal via percent-encoded paths.
• Changed a default setting to enforce server-side EdgeID on first connection.
• Authentication cookies now have the Secure attribute set automatically when Portainer is accessed over HTTPS.
• Upgraded golang.org/x/net to v0.54.0 to address CVE-2026-27141 and CVE-2026-33814.
• Upgraded github.com/go-git/go-git/v5 to v5.19.0 to address CVE-2026-34165, GHSA-3xc5-wrhm-f963, and CVE-2026-33762.
• Upgraded github.com/in-toto/in-toto-golang to v0.11.0 to address GHSA-pmwq-pjrm-6p5r.
• Upgraded github.com/Azure/go-ntlmssp to v0.1.1 to address CVE-2026-32952.
• Upgraded github.com/prometheus/prometheus to v0.311.3 to address CVE-2026-40179, GHSA-fw8g-cg8f-9j28, and CVE-2026-42151.

Bug fixes

• Fixed TLS configuration being accepted for Edge Agent environments via API (TLS is now correctly rejected for Edge Agent environment creation and updates).
• Fixed stack deployments hanging due to deadlock during ECR token refresh under concurrent stack deployments.
• Fixed Chisel panic caused by a negative WaitGroup counter.
• Fixed stack images being pulled in parallel causing rate-limiting failures; images are now pulled sequentially and COMPOSE_PARALLEL_LIMIT is respected.
• Fixed GitOps polling stopping permanently after a deployment error; auto-update now resumes correctly on subsequent polling cycles.
• Fixed GitOps auto-update skipping re-deployment when the commit hash was persisted before the deployment attempt; the hash is now only written after the deploy status is saved.
• Fixed an issue where editing a private git stack required re-entering credentials due to incorrect form validation and missing stack ID in gitops API calls.
• Fixed “Stack ID required” error appearing when viewing logs for containers not part of a stack.
• Fixed re-pull and redeploy operation to use the compose service for image pulling.
• Fixed kubectl-shell-image flag only taking effect on the first Portainer run; the flag is now re-applied on each restart.
• Fixed Kubernetes application edit buttons not working for Git-managed applications.
• Fixed effective access viewer not including policies when calculating user access.
• Fixed volume browsing failure when Docker data root is set to a non-default path.
• Fixed incorrect OS labels for edge agent and Docker API environments (Linux/Windows labels now aligned).
• Fixed change confirmation dialog incorrectly appearing during Helm deployment creation.
• Fixed Edge environment URLs displayed on the home page incorrectly showing the Portainer server URL; the URL is now hidden on the list view and the server/tunnel URLs are shown on the environment detail panel instead.
• Fixed environments with unknown version incorrectly showing as “outdated”.
• Fixed dropdown menus in the Omni wizard being hidden behind the sticky footer.
• Fixed missing icon in the host details view.
• Fixed sidebar parent menu items appearing misaligned.
• Fixed age filter on the home page not persisting across page reloads.
• Fixed Edge environment creation failing for CE users.

Deprecated and removed features

Deprecated features

None.

Removed features

• Removed OpenAMT integration.

Known issues

• On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot

Known issues with Podman support

• Podman environments aren't supported by auto-onboarding script
• It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
• Support for only CentOS 9, Podman 5 rootful

Changes

• Added Age as a sort option on the Home environments list and made it the default sort order, with "Oldest" (ascending by environment ID) and "Newest" (descending) toggles
• Fixed the Talos Cluster Details page rendering blank by reverting the Omni cluster phase fields to int32 so they match the frontend OmniClusterPhase / OmniClusterUpgradePhase enum contract

Deprecated and removed features

Deprecated features

None.

Removed features

None

Known issues

• On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot

Known issues with Podman

• Podman environments aren't supported by auto-onboarding script
• It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
• Support for only CentOS 9, Podman 5 rootful

Changes

• Fixed an issue where the kubectl-shell-image flag only takes effect on the first Portainer run
• Fixed an issue where deleting a kube edge stack results in a downed environment
• Fixed an issue where Edge stack deployment retries stopped working
• Fixed an issue with saving Git credentials
• Fixed a Docker API proxy authorisation bypass that allowed regular users to circumvent deny-plugin restrictions
• Changed a default setting to enforce server-side EdgeID on first connection
• Fixed a bind mount restriction bypass via HostConfig.Mounts during container creation
• Fixed a bind mount restriction bypass during Swarm service creation
• Fixed a container capabilities and sysctl restriction bypass during Swarm service creation
• Fixed an issue where the CronJob executions are not filtered by namespace - same-name CronJobs across namespaces show identical execution lists
• Fixed an issue where the request failed with status code 504
• Removed the option to pass a JWT token as a query string parameter
• Upgraded typescript to v6
• Fixed the TLS certificate uploading
• Fixed a stacks issue where stack.env can be null
• Ensured Portainer pulls images sequentially and respects COMPOSE_PARALLEL_LIMIT
• Removed the possibility to clone Git repositories that contain symlinks
• Fixed a DB write deadlock on ECR token refresh during stack redeployment
• Enforced admin permissions when updating endpoint relations
• Enforced admin permission in /system
• Fixed handling no healthcheck logs output
• Resolved the following CVEs:
  • CVE-2026-35469
  • CVE-2026-32280
  • CVE-2026-32281
  • CVE-2026-32283
  • CVE-2026-32282
  • CVE-2026-32289
  • CVE-2026-32288
  • CVE-2026-25679
  • CVE-2026-27142
  • CVE-2026-27139
  • CVE-2026-32285
  • CVE-2026-39883
  • CVE-2026-39882
  • GHSA-xmrv-pmrh-hhx2
  • CVE-2026-32952
  • CVE-2026-34165
  • CVE-2026-33762
  • GHSA-3xc5-wrhm-f963
  • CVE-2026-35206
  • GHSA-xmrv-pmrh-hhx2
  • CVE-2026-39882
  • GHSA-3xc5-wrhm-f963
  • CVE-2026-31789
  • CVE-2026-28387
  • CVE-2026-28388
  • CVE-2026-28390
  • CVE-2026-31790
  • CVE-2026-28389
  • CVE-2026-2673
  • CVE-2026-40200
  • CVE-2026-6042
  • CVE-2026-22184
  • CVE-2026-27171

Deprecated and removed features

Deprecated features

None.

Removed features

None

Known issues

• On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot

Known issues with Podman support

• Podman environments aren't supported by auto-onboarding script
• It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
• Support for only CentOS 9, Podman 5 rootful

Changes

• Fixed a Docker API proxy authorisation bypass that allowed regular users to circumvent deny-plugin restrictions
• Changed a default setting to enforce server-side EdgeID on first connection
• Fixed a path traversal vulnerability in custom template handling
• Fixed unauthorized access to custom template file contents via a direct API endpoint
• Removed the option to pass a JWT token as a query string parameter
• Removed the possibility to clone Git repositories that contain symlinks
• Fixed a bind mount restriction bypass via HostConfig.Mounts during container creation
• Fixed a bind mount restriction bypass during Swarm service creation
• Fixed a container capabilities and sysctl restriction bypass during Swarm service creation
• Fixed an error handling condition in the database
• Added missing return statements to prevent continued execution after failed authorisation checks
• Fixed an issue where Edge stack deployment retries stopped working
• Resolved the following CVEs:
  • CVE-2026-25679
  • CVE-2026-27139
  • CVE-2026-27142
  • CVE-2026-32280
  • CVE-2026-32281
  • CVE-2026-32282
  • CVE-2026-32283
  • CVE-2026-32288
  • CVE-2026-32289
  • CVE-2025-58058
  • CVE-2026-1229
  • CVE-2026-24051
  • CVE-2026-25934
  • CVE-2026-32285
  • CVE-2026-32952
  • CVE-2026-33186
  • CVE-2026-33762
  • CVE-2026-34165
  • CVE-2026-35206
  • CVE-2026-35469
  • CVE-2026-39882
  • CVE-2026-39883
  • GHSA-3xc5-wrhm-f963
  • GHSA-xmrv-pmrh-hhx2

Deprecated and removed features

Deprecated features

None.

Removed features

None

Known issues

• On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot

Known issues with Podman support

• Support for only CentOS 9, Podman 5 rootful

Changes

Breaking changes

Changes to the CSRF protection implementation may cause failures when upgrading:

• Portainer fails to start with a fatal log entry like failed to build server | error="invalid url for trusted origin... trusted_origin: \"portainer.example.com\"". The new implementation requires each entry in the trusted origins list to be a full URL including scheme (e.g. https://portainer.example.com/); bare hostnames are no longer accepted.
• Browser requests return 403 Forbidden on state-changing actions, with CSRF check failed entries in the server logs. This means the browser's origin is not in the trusted origins list and needs to be added.

The previous CSRF implementation can be re-enabled by starting Portainer with the legacy-csrf feature flag (-feat legacy-csrf). This flag is provided for 2.41 only and is scheduled for removal in 2.42 — please report any problems so they can be addressed before the flag is removed.

New and improved features

• Added support for deploying Helm chart edge stacks sourced from Helm repositories and Git repositories.
• Reworked Docker stack creation and deployment to an async flow for consistent behaviour with Compose.
• Kubernetes Manifest GitOps stacks can now be edited after deployment — admins can update the Git repository URL, reference, manifest filename, and credentials from the application detail view instead of tearing down and recreating the stack.
• Added TUI (text-based UI) application support to the Web Console and kubectl shell, including proper terminal resize handling.
• Added a "Redeploy" button to the Git-backed stack detail view for pulling and redeploying from the repository.
• Added visible rendering of special and non-printable characters in the web code editor.
• Added Edit YAML and Describe actions to Services, Jobs, CronJobs, Roles, RoleBindings, ClusterRoles, and ClusterRoleBindings datatables in the Kubernetes UI.
• Added support for pruning unused Docker images from the Images list, with a confirmation modal.
• Refreshed the navigation bar and page header styling.
• Added a registry-access notice on Kubernetes app create/edit and Helm install/upgrade views to guide users to configure registry access.
• Added a GitOps Workflows page — a new top-level sidebar item that lists every GitOps workflow across environments and edge stacks with a status summary bar, sortable list, and cross-jump to each stack's edit view. The backing API is RBAC-aware: admins see everything; Edge admins see Edge-stack workflows; environment and Kubernetes-namespace operators see workflows scoped to what they manage; standard users see workflows on stacks they can access via team membership.
• Added custom namespace support when deploying Helm-based edge stacks.
• Home UI improvements to highlight environment groups.

Security improvements

• Bumped Go toolchain to 1.26.2 to remediate the following CVEs:
  • CVE-2026-32280 (crypto/x509 excessive chain-building work in Verify, denial of service)
  • CVE-2026-32281 (crypto/x509 inefficient policy validation, denial of service)
  • CVE-2026-32283 (crypto/tls 1.3 key update deadlock, uncontrolled resource consumption)
  • CVE-2026-33810 (crypto/x509 excluded DNS constraints not applied to wildcard domains in different case)
• Bumped helm.sh/helm/v4 to v4.1.4 to remediate the following CVEs:
  • CVE-2026-35204 (plugin version path traversal enables arbitrary file write; GHSA-vmx8-mqv2-9gmg)
  • CVE-2026-35205 (plugin missing-provenance signature-verification bypass; GHSA-q5jf-9vfq-h4h7)
• Bumped github.com/moby/spdystream to v0.5.1 to remediate CVE-2026-35469.
• Upgraded the bundled Docker binary from v29.3.0 to v29.4.1 (agent, server-ce, server-ee, compose-unpacker), picking up Go 1.25.8 and 1.25.9 to mitigate the following CVEs:
  • CVE-2026-25679
  • CVE-2026-27142
  • CVE-2026-27139
  • CVE-2026-32280
  • CVE-2026-32281
  • CVE-2026-32283
  • CVE-2026-32282
  • CVE-2026-32289
  • CVE-2026-32288

Bug fixes

• Fixed keyword search failing to highlight matches in application and container log views.
• Fixed several data races in Kubernetes environment detection by switching to transactional code.
• Fixed a use-after-close data race in the endpoint force-update service.
• Cached the MOTD on the server to eliminate a banner-related layout shift on page load.
• Fixed published-port rendering in the Containers list so the icon and port text appear on the same row instead of wrapping to separate lines.
• Fixed the Container details page rendering as empty when the container reports a healthcheck with an empty Log array (the check now uses health.Log?.length).
• Fixed the Deploy button not re-enabling when editing a running stack's YAML.
• Reworked the stack update flow to the async model already used for stack create.
• Fixed a goroutine leak in the Kubernetes pod exec websocket handler.
• Fixed InvalidateUserKeyCache returning an incorrect value.
• Fixed Git repository errors returning raw HTML by returning a clean error message instead.
• Fixed a "missing file" error when updating a Git-backed stack's repository URL.
• Fixed Git credentials not being saved when creating or updating repository-backed stacks.
• Suppressed noisy error toasts from repository validation queries by honouring the meta.error flag.
• Reduced noisy repository validation requests and fixed assorted errors on the GitOps form.
• Fixed a data race in Docker service restore caused by a shared handler field.
• Added a success toast when a stack is deployed.
• Fixed several potential nil-pointer dereferences across Kubernetes (applications, cronjob, ingress, job, pod, custom resources), LDAP, EKS, and Edge revoke code paths.
• Fixed the volume dropdown blanking out after selection when creating a container — the selected volume name now stays visible in the control.
• Fixed kubectl shell issues including closing the terminal on Ctrl+D.
• Fixed a data race in the portainer-updater container health checker.
• Fixed a resource leak in the portainer-updater log query helper.
• Fixed a websocket data race and goroutine leak by adding proper locking around hijacked connections.
• Fixed Edge stack retry on the agent: the FirstAction timestamp was captured once and never reset, causing retries to silently stop working 7 days after the agent first saw a stack. It's now reset on each deployment so retries work for the configured window from the latest action.
• Fixed Kubernetes CronJob executions showing identical lists for same-named CronJobs across namespaces.
• Removed the non-functional items-per-page selector from the Kubernetes CronJob executions datatable.
• Fixed malformed YAML documents in the Kubernetes web editor.
• Fixed an issue where a modal could outgrow the viewport and not be visible.
• Adjusted page header padding and spacing, and fixed breadcrumb first-item rendering.

Deprecated and removed features

Deprecated features

None.

Removed features

• Removed MicroK8s cluster provisioning and management integration from the EE server.