Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/containers/podman

17 known vulnerabilities (1 critical, 6 high, 7 medium), with the versions each affects and the releases that fix them.

Latest release
v1.4.2 (Jun 18, 2019): affected by 14 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
17 · 1 critical, 6 high, 7 medium
Releases
54 since v0.2.1 (Feb 16, 2018)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Show all 17 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 17

  • CVE-2026-94603Critical 10.0

    Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation

    Affected: all versions.

    No fix released. The latest release, v1.4.2, is still affected.

  • CVE-2026-19730Medium 4.2

    Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives

    Affected: all versions.

    No fix released. The latest release, v1.4.2, is still affected.

  • CVE-2026-55686Medium 5.3

    Podman: WORKDIR symlink traversal vulnerability

    Affected: all versions.

    No fix released. The latest release, v1.4.2, is still affected.

  • Podman: Malformed Image can trick podman run into leaking host environment variables into the container

    Affected: from 1.8.1; all versions.

    No fix released. The latest release, v1.4.2, is still affected.

  • CVE-2026-33414Medium 4.0

    PowerShell Command Injection in Podman HyperV Machine

    Affected: all versions.

    No fix released. The latest release, v1.4.2, is still affected.

  • Podman: build context bind mount

    Affected: all versions.

    No fix released. The latest release, v1.4.2, is still affected.

  • Podman: podman kube play command may overwrite host files

    Affected: all versions.

    No fix released. The latest release, v1.4.2, is still affected.

  • Podman: podman missing tls verification

    Affected: all versions.

    No fix released. The latest release, v1.4.2, is still affected.

  • CVE-2024-9407Medium 4.7

    Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction

    Affected: fixed in 5.2.4; all versions.

    No fix released. The latest release, v1.4.2, is still affected.

  • Podman: kernel: containers in shared ipc namespace are vulnerable to denial of service attack

    Affected: through 5.2.0; all versions.

    No fix released. The latest release, v1.4.2, is still affected.

  • CVE-2022-4122Medium 5.3

    A vulnerability was found in buildah.

    Affected: all versions.

    No fix released. The latest release, v1.4.2, is still affected.

  • A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions.

    Affected: all versions.

    No fix released. The latest release, v1.4.2, is still affected.

  • A flaw was found in podman.

    Affected: all versions.

    No fix released. The latest release, v1.4.2, is still affected.

  • CVE-2020-1726Medium 5.9

    A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they…

    Affected: from 1.6.0, fixed in 2.0.6.

    No fix released. The advisory names 2.0.6 as the fix, which the registry doesn't have yet.

  • An issue was discovered in Podman in libpod before 1.6.0.

    Affected: all versions.

    No fix released. The latest release, v1.4.2, is still affected.

Show all 17 advisoriesShow fewer advisories

  • A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers.

    Affected: fixed in 1.4.0.

    Fixed in v1.4.0 (released Jun 7, 2019, 53 days before disclosure).

    The latest release, v1.4.2, is not affected.

  • CVE-2018-10856Medium 5.3

    It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user.

    Affected: fixed in 0.6.1.

    Fixed in v0.6.1 (released Jun 1, 2018, 31 days before disclosure).

    The latest release, v1.4.2, is not affected.