Update docker.io/portainer/portainer-ce Docker tag to v2.45.0

v2.45.0: LTS

Compare Source

Known issues

• On Async Edge environments, an invalid update schedule date can be displayed when browsing a snapshot

Known issues with Podman support

• Podman environments aren't supported by auto-onboarding script
• It's not possible to add Podman environments via socket, when running a Portainer server on Docker (and vice versa)
• Support for only CentOS 9, Podman 5 rootful

Changes

New and improved features

• Added advanced Kubernetes node drain options with agent failover
• Added native Portainer APIs for writing Kubernetes secrets, configmaps, deployments and persistent volume claims, replacing direct kube-apiserver proxy calls
• Added a generic Kubernetes manifest dry-run API
• Edge Compute settings can now be configured during initial setup and via cli flags
• Authentication events now record the real client IP from X-Forwarded-For when the request comes through a trusted proxy
• The namespace YAML tab now shows every resource quota in the namespace
• Added GetCharts() support to the async Edge agent, so chart data syncs on agent startup
• Edge agent connectivity checks now report progress while probing, and wait longer before failing
• Creating a git source now skips the source type selection step
• The source form now explains git polling versus webhook triggers, and exposes the polling interval setting that was missing from the UI
• Removed the redundant single-tab handle from the workflow details view
• Reworded the registry creation tooltip to make the default behaviour obvious
• Clarified that Portainer supports Podman through its Docker-compatible API only

Security improvements

• Fixed a critical Docker proxy authorization bypass. Unrecognised API version prefixes like /v1.47.0/ or /v01.47/ skipped access control entirely, letting non-admin users reach the Docker API directly
• Closed a remaining gap in the CVE-2026-44849 (GHSA-5fxq-qcf3-244w) fix and broadened bind-mount restrictions for non-admin users, now including Compose and Swarm stack deployments
• Single-namespace Kubernetes endpoints now check the caller’s namespace authorization instead of running as admin
• Read-only and Helpdesk users can no longer view Kubernetes secret data
• Standard users can no longer manage registry access
• Kubernetes authorization denials now return HTTP 403 instead of 500
• Fixed a Kubernetes shell authorization flaw. Caller-supplied query parameters could override the server's pod target, letting a standard user run commands in any pod on Agent-managed Kubernetes environments
• Updated the Go toolchain to 1.26.6, fixing CVE-2026-39821 (Critical, 9.6), an IDNA validation bypass of hostname-based access controls, along with CVE-2026-42505, CVE-2026-39822, CVE-2026-56862, CVE-2026-56860, CVE-2026-56859, CVE-2026-56858, CVE-2026-56853, CVE-2026-46600 and CVE-2026-33818
• Updated oras.land/oras-go/v2 to 2.6.2, fixing CVE-2026-50163
• Updated github.com/go-git/go-git/v5 to 5.19.2, fixing CVE-2026-71556 and CVE-2026-71557
• Updated go.opentelemetry.io/otel to 1.44.0, fixing CVE-2026-41178
• Updated github.com/klauspost/compress to 1.18.7, fixing GHSA-259r-337f-4rfw
• Upgraded libcurl to 8.21.0-r0 in the kubectl-shell image to address the following CVEs: CVE-2026-11856, CVE-2026-10536, CVE-2026-11564, CVE-2026-12064, CVE-2026-11586, CVE-2026-11352, CVE-2026-9547, CVE-2026-9546, CVE-2026-9545, CVE-2026-9080, CVE-2026-9079, CVE-2026-8932, CVE-2026-8927, CVE-2026-8926, CVE-2026-8925, CVE-2026-8924, CVE-2026-8458, and CVE-2026-8286.
• Upgraded c-ares to 1.34.8-r0 in the kubectl-shell image to address CVE-2026-33630

Bug fixes

• Removing a stack now uninstalls the underlying Helm release, which used to be left running
• Fixed Edge stack workloads staying up after deletion on Kubernetes. The entry file and namespace are now sent on removal
• Fixed collisions during Edge stack removal and reassignment. The old stack is now removed before the new one deploys
• Fixed Lstat /data/edge_stacks/<id>/v1: no such file or directory on Kubernetes async agents by persisting the artifact commit hash before creating the Edge stack
• Fixed Azure Blob backup settings not saving, by resolving redacted credentials on write
• Fixed manual team-membership sync diverging from login-time sync by sharing a single implementation
• Fixed server-managed API key metadata fields being wiped on policy update
• Fixed spaces in setup policy names causing Kubernetes label errors
• Fixed the Policies card on the Kubernetes dashboard not counting all applied policy types
• Policy operations now return a meaningful error when the policy isn’t found, instead of a bare 404
• Fixed the Edit button being disabled for a Helm chart stack deployed from GitHub
• Fixed the browser title bar staying stuck on “Loading” after a page refresh
• Fixed multiple error toasts appearing for a metrics time range over 31 days, and stopped the request over-retrying
• Fixed alert modal validation desyncing from the input
• Fixed the “Open in OneUptime” navigation using an incorrect URL
• Fixed the Uninstall button being enabled in the add-on list but disabled in the detail view while an install was running
• The Restart button is no longer shown for failed add-on installs

Deprecated and removed features

Deprecated features

None.

Removed features

None

Community contributions since 2.39.0 LTS

A huge thank you to all our community contributors.
This LTS release rolls up work from the 2.40 to 2.44 STS releases, including fixes and improvements contributed by these community members:

• Nguyen Quang Minh (@​minhng99) - corrected the OAuth scope placeholder format
• Zach (@​zacxihu) - relative env_file: paths now resolve against the compose file's directory, fixing Git sub-directory stacks
• Rian Moraes (@​rshmdev) - env var descriptions now shown as tooltips in application templates
• Siddam Vinay (@​siddamvinay2001) - truncated published-port lists with a show-more badge, and made early async Swarm deploy failures surface instead of reporting success
• Immanuel Tikhonov (@​immanuwell) - fixed a registry cache type mismatch that meant the cache never hit
• @​ferreiraborgesaxel-design - fixed reversed markdown link syntax in the contributing docs
• Ion Jaureguialzo Sarasola (@​ijaureguialzo) - fixed a Kubernetes crash on malformed web-editor manifests
• Du Feilong (@​dfldylan) and Jerry (@​jerry-yuan) - added Docker --security-opt support and Swarm cluster self-heal after manager reap
• SRIKANTH K (@​srikanth-karthi) - Portainer now tolerates malformed OAuth Content-Type headers from resource endpoints