Overview
Portainer has released a new long-term support (LTS) update, consolidating improvements from the 2.40 through 2.44 short-term support releases. This release focuses on Kubernetes management, security hardening, and Edge computing enhancements.
New Features and Improvements
Kubernetes users gain advanced node drain options with agent failover, native Portainer APIs for writing secrets, configmaps, deployments, and persistent volume claims (replacing direct kube-apiserver proxy calls), and a generic manifest dry-run API. Edge Compute settings can now be configured during initial setup and via CLI flags. Authentication events record the real client IP from X-Forwarded-For behind a trusted proxy. The namespace YAML tab now shows every resource quota. Async Edge agents support GetCharts() for chart data sync on startup, and connectivity checks report progress and wait longer before failing.
Creating a git source now skips source type selection, and the source form explains git polling versus webhook triggers while exposing the polling interval. The workflow details view has been simplified, registry creation tooltips clarified, and Podman support is noted as only through its Docker-compatible API.
Security Improvements
Critical security fixes include a Docker proxy authorization bypass that allowed non-admin users to reach the Docker API with unrecognized version prefixes. The CVE-2026-44849 fix was extended to cover Compose and Swarm stack deployments, broadening bind-mount restrictions. Single-namespace Kubernetes endpoints now enforce caller authorization, and read-only or Helpdesk users can no longer view Kubernetes secret data. Standard users cannot manage registry access, and Kubernetes authorization denials now return HTTP 403. A Kubernetes shell authorization flaw that let callers override pod targets via query parameters was also fixed.
Dependency updates addressed numerous CVEs: Go toolchain 1.26.6 fixed CVE-2026-39821 (critical IDNA validation bypass) plus CVE-2026-42505, CVE-2026-39822, CVE-2026-56862, CVE-2026-56860, CVE-2026-56859, CVE-2026-56858, CVE-2026-56853, CVE-2026-46600, CVE-2026-33818; oras-go 2.6.2 fixed CVE-2026-50163; go-git 5.19.2 fixed CVE-2026-71556 and CVE-2026-71557; OpenTelemetry 1.44.0 fixed CVE-2026-41178; klauspost/compress 1.18.7 fixed GHSA-259r-337f-4rfw; libcurl 8.21.0 in kubectl-shell fixed 18 CVEs including CVE-2026-11856, CVE-2026-10536, CVE-2026-11564, CVE-2026-12064, CVE-2026-11586, CVE-2026-11352, CVE-2026-9547, CVE-2026-9546, CVE-2026-9545, CVE-2026-9080, CVE-2026-9079, CVE-2026-8932, CVE-2026-8927, CVE-2026-8926, CVE-2026-8925, CVE-2026-8924, CVE-2026-8458, CVE-2026-8286; and c-ares 1.34.8 fixed CVE-2026-33630.
Bug Fixes
Numerous bug fixes improve stack management: removing a stack now uninstalls its Helm release, Edge stack workloads are properly deleted on Kubernetes, collisions during Edge stack removal are resolved, and an async agent file error is fixed. Azure Blob backup settings now save correctly. Team membership sync is unified between manual and login-time operations. Server-managed API key metadata is preserved on policy updates. Spaces in policy names no longer cause Kubernetes label errors, and the Policies card counts all applied policy types. Policy operations return meaningful errors when a policy is missing. The Edit button works for Helm chart stacks from GitHub. The browser title no longer gets stuck on “Loading”. Error toasts for metrics time ranges over 31 days are reduced, alert modal validation stays in sync, OneUptime navigation uses the correct URL, and the Uninstall button now behaves consistently during add-on installs, with the Restart button hidden for failed installs.
Known Issues
On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot. Podman support remains limited: the auto-onboarding script does not support Podman environments, adding Podman via socket is not possible when running Portainer on Docker (and vice versa), and only CentOS 9 with Podman 5 rootful is supported.
Deprecated and Removed Features
No features were deprecated or removed in this release.
Community Contributions
A huge thank you to the community contributors who helped improve this LTS release. Contributors fixed OAuth scope placeholder formatting (Nguyen Quang Minh), relative env_file path resolution (Zach), env var tooltips (Rian Moraes), published-port lists and Swarm deploy failure reporting (Siddam Vinay), registry cache mismatch (Immanuel Tikhonov), reversed markdown link syntax (a community member), Kubernetes crash on malformed manifests (Ion Jaureguialzo Sarasola), Docker –security-opt and Swarm self-heal (Du Feilong and Jerry), and OAuth Content-Type tolerance (SRIKANTH K).
