# github.com/containers/podman (Go) vulnerabilities 17 known vulnerabilities (1 critical, 6 high, 7 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v1.4.2 (Jun 18, 2019): affected by 14 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 54 since v0.2.1 (Feb 16, 2018) - Registry: https://pkg.go.dev/github.com/containers/podman - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-94603: v0.2.1 to v1.4.2 (through the newest release) - CVE-2026-19730: v0.2.1 to v1.4.2 (through the newest release) - CVE-2026-55686: v0.2.1 to v1.4.2 (through the newest release) - CVE-2026-57231: v0.2.1 to v1.4.2 (through the newest release) - CVE-2026-33414: v0.2.1 to v1.4.2 (through the newest release) - CVE-2025-4953: v0.2.1 to v1.4.2 (through the newest release) - CVE-2025-9566: v0.2.1 to v1.4.2 (through the newest release) - CVE-2025-6032: v0.2.1 to v1.4.2 (through the newest release) - CVE-2024-9407: v0.2.1 to v1.4.2 (through the newest release) - CVE-2024-3056: v0.2.1 to v1.4.2 (through the newest release) - CVE-2022-4122: v0.2.1 to v1.4.2 (through the newest release) - CVE-2022-27649: v0.2.1 to v1.4.2 (through the newest release) - CVE-2021-4024: v0.2.1 to v1.4.2 (through the newest release) - CVE-2020-1726: no published release is affected - CVE-2019-18466: v0.2.1 to v1.4.2 (through the newest release) - CVE-2019-10152: v0.2.1 to v1.3.2 (v1.4.0 is outside it) - CVE-2018-10856: v0.2.1 to v0.5.4 (v0.6.1 is outside it) ## Advisories (17) ### [CVE-2026-94603](https://cve.now/CVE-2026-94603): Podman: The \`podman run\` command can be instructed to disable almost all sandboxing by image annotation - Severity: Critical 10.0 - Published: Oct 13, 2026 - Affected: all versions. - No fix released. The latest release, v1.4.2, is still affected. ### [CVE-2026-19730](https://cve.now/CVE-2026-19730): Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives - Severity: Medium 4.2 - Published: Aug 13, 2026 - Affected: all versions. - No fix released. The latest release, v1.4.2, is still affected. ### [CVE-2026-55686](https://cve.now/CVE-2026-55686): Podman: WORKDIR symlink traversal vulnerability - Severity: Medium 5.3 - Published: Jun 26, 2026 - Affected: all versions. - No fix released. The latest release, v1.4.2, is still affected. ### [CVE-2026-57231](https://cve.now/CVE-2026-57231): Podman: Malformed Image can trick podman run into leaking host environment variables into the container - Severity: High 7.5 - Published: Jun 26, 2026 - Affected: from 1.8.1; all versions. - No fix released. The latest release, v1.4.2, is still affected. ### [CVE-2026-33414](https://cve.now/CVE-2026-33414): PowerShell Command Injection in Podman HyperV Machine - Severity: Medium 4.0 - Published: Apr 14, 2026 - Affected: all versions. - No fix released. The latest release, v1.4.2, is still affected. ### [CVE-2025-4953](https://cve.now/CVE-2025-4953): Podman: build context bind mount - Severity: High 7.4 - Published: Sep 16, 2025 - Affected: all versions. - No fix released. The latest release, v1.4.2, is still affected. ### [CVE-2025-9566](https://cve.now/CVE-2025-9566): Podman: podman kube play command may overwrite host files - Severity: High 8.1 - Published: Sep 5, 2025 - Affected: all versions. - No fix released. The latest release, v1.4.2, is still affected. ### [CVE-2025-6032](https://cve.now/CVE-2025-6032): Podman: podman missing tls verification - Severity: High 8.3 - Published: Jun 24, 2025 - Affected: all versions. - No fix released. The latest release, v1.4.2, is still affected. ### [CVE-2024-9407](https://cve.now/CVE-2024-9407): Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction - Severity: Medium 4.7 - Published: Oct 1, 2024 - Affected: fixed in 5.2.4; all versions. - No fix released. The latest release, v1.4.2, is still affected. ### [CVE-2024-3056](https://cve.now/CVE-2024-3056): Podman: kernel: containers in shared ipc namespace are vulnerable to denial of service attack - Severity: High 7.7 - Published: Aug 2, 2024 - Affected: through 5.2.0; all versions. - No fix released. The latest release, v1.4.2, is still affected. ### [CVE-2022-4122](https://cve.now/CVE-2022-4122): A vulnerability was found in buildah. - Severity: Medium 5.3 - Published: Dec 8, 2022 - Affected: all versions. - No fix released. The latest release, v1.4.2, is still affected. ### [CVE-2022-27649](https://cve.now/CVE-2022-27649): A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. - Severity: Unrated - Published: Apr 4, 2022 - Affected: all versions. - No fix released. The latest release, v1.4.2, is still affected. ### [CVE-2021-4024](https://cve.now/CVE-2021-4024): A flaw was found in podman. - Severity: Unrated - Published: Dec 23, 2021 - Affected: all versions. - No fix released. The latest release, v1.4.2, is still affected. ### [CVE-2020-1726](https://cve.now/CVE-2020-1726): A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they… - Severity: Medium 5.9 - Published: Feb 11, 2020 - Affected: from 1.6.0, fixed in 2.0.6. - No fix released. The advisory names 2.0.6 as the fix, which the registry doesn't have yet. ### [CVE-2019-18466](https://cve.now/CVE-2019-18466): An issue was discovered in Podman in libpod before 1.6.0. - Severity: Unrated - Published: Oct 28, 2019 - Affected: all versions. - No fix released. The latest release, v1.4.2, is still affected. ### [CVE-2019-10152](https://cve.now/CVE-2019-10152): A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. - Severity: High 7.5 - Published: Jul 30, 2019 - Affected: fixed in 1.4.0. - Fixed in v1.4.0 (released Jun 7, 2019, 53 days before disclosure). - The latest release, v1.4.2, is not affected. ### [CVE-2018-10856](https://cve.now/CVE-2018-10856): It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. - Severity: Medium 5.3 - Published: Jul 2, 2018 - Affected: fixed in 0.6.1. - Fixed in v0.6.1 (released Jun 1, 2018, 31 days before disclosure). - The latest release, v1.4.2, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/containers/podman Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.