# Portainer 2.39.6 — Release 2.39.6 LTS

- Product: Portainer (https://whatsnew.fyi/product/portainer)
- Vendor: Portainer
- Date: 2026-08-12
- Version: 2.39.6
- Original notes: https://github.com/portainer/portainer/releases/tag/2.39.6
- Permalink: https://whatsnew.fyi/product/portainer/releases/2.39.6

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Implemented an SSRF protection mechanism with a configurable allow-list in settings (off / audit / enforce modes)
- **security** — Changed a default setting to enforce server-side EdgeID on first connection
- **security** — Fixed path traversal in the swarm compose deployer, where configs/secrets file paths escaped the project root
- **security** — Upgraded the Go toolchain from 1.25.11 to 1.25.12 to address CVE-2026-42505 and CVE-2026-39822
- **security** — Upgraded github.com/go-git/go-git/v5 to 5.19.2 to address CVE-2026-71556 and CVE-2026-71557
- **security** — Upgraded oras.land/oras-go/v2 to 2.6.2 to address CVE-2026-50163
- **security** — Upgraded go.opentelemetry.io/otel to 1.44.0 to address CVE-2026-41178
- **security** — Upgraded github.com/klauspost/compress to 1.18.7 to address GHSA-259r-337f-4rfw
- **security** — Upgraded golang.org/x/net to 0.56.0 and golang.org/x/text to 0.39.0 in the Portainer updater to address CVE-2026-46600 and CVE-2026-56852
- **security** — Upgraded github.com/containerd/containerd (v1) to 1.7.33 to address CVE-2026-53488 and CVE-2026-47262
- **security** — Upgraded google.golang.org/grpc to 1.82.1 to address GHSA-hrxh-6v49-42gf
- **fixed** — Fixed a user's direct environment access being incorrectly removed when a team they belonged to was deleted
- **fixed** — Fixed multiple "Cannot read properties of undefined (reading 'message')" error toasts appearing on Kubernetes application pages when an API call failed without a response
- **fixed** — Fixed an "Invalid Swarm ID" / 503 error when creating a stack from a Swarm worker node
- **fixed** — Fixed Kubernetes Ingress service ports always showing 0
- **fixed** — Fixed kubectl port-forward failing with "error upgrading connection" against Agent 2.35+ on older Kubernetes clusters
- **fixed** — Fixed "This node is not a swarm manager" errors when starting/stopping a Swarm stack from within the swarm itself
- **fixed** — Fixed Docker image builds failing with unauthorized against private registries referenced in a Dockerfile's FROM line
- **fixed** — Fixed Swarm stack deployments failing to re-pull private Docker Hub images on a forced re-pull, even with valid registry credentials configured
- **fixed** — Fixed request-handler panics being logged as unexpected crashes when a client disconnected mid-request

##### Known issues

- On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot

###### Known issues with Podman support

- Podman environments aren't supported by auto-onboarding script
- It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
- Support for only CentOS 9, Podman 5 rootful

##### Changes

###### Security improvements

- Implemented an SSRF protection mechanism with a configurable allow-list in settings (off / audit / enforce modes)
- Changed a default setting to enforce server-side EdgeID on first connection
- Fixed path traversal in the swarm compose deployer, where configs/secrets file paths escaped the project root
- Upgraded the Go toolchain from 1.25.11 to 1.25.12 to address the following CVEs:
    - CVE-2026-42505
    - CVE-2026-39822
- Upgraded `github.com/go-git/go-git/v5` to 5.19.2 to address the following CVEs:
    - CVE-2026-71556
    - CVE-2026-71557
- Upgraded `oras.land/oras-go/v2` to 2.6.2 to address CVE-2026-50163
- Upgraded `go.opentelemetry.io/otel` to 1.44.0 to address CVE-2026-41178
- Upgraded `github.com/klauspost/compress` to 1.18.7 to address GHSA-259r-337f-4rfw
- Upgraded `golang.org/x/net` to 0.56.0 and `golang.org/x/text` to 0.39.0 in the Portainer updater to address the following CVEs:
    - CVE-2026-46600
    - CVE-2026-56852
- Upgraded `github.com/containerd/containerd` (v1) to 1.7.33 to address the following CVEs:
    - CVE-2026-53488
    - CVE-2026-47262
    - Upgraded `google.golang.org/grpc` to 1.82.1 to address GHSA-hrxh-6v49-42gf

###### Bug fixes

- Fixed a user's direct environment access being incorrectly removed when a team they belonged to was deleted
- Fixed multiple "Cannot read properties of undefined (reading 'message')" error toasts appearing on Kubernetes application pages when an API call failed without a response (e.g. while pods are restarting after a redeploy)
- Fixed an "Invalid Swarm ID" / `503` error when creating a stack from a Swarm worker node
- Fixed Kubernetes Ingress service ports always showing `0`
- Fixed `kubectl port-forward` failing with "error upgrading connection" against Agent 2.35+ on older Kubernetes clusters
- Fixed "This node is not a swarm manager" errors when starting/stopping a Swarm stack from within the swarm itself
- Fixed Docker image builds failing with `unauthorized` against private registries referenced in a Dockerfile's `FROM` line (both the UI's "Build a new image" flow and the `/docker/build` API proxy)
- Fixed Swarm stack deployments failing to re-pull private Docker Hub images on a forced re-pull, even with valid registry credentials configured
- Fixed request-handler panics being logged as unexpected crashes when a client disconnected mid-request (e.g. a long-poll on a Kubernetes Jobs watch)

##### Deprecated and removed features

###### Deprecated features

None.

###### Removed features

None