github.com/containers/podman/v2

Version timeline

Advisories 17

• CVE-2026-94603Critical 10.0

  Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation

  Affected: all versions.

  No fix released. The latest release, v2.2.1, is still affected.

• CVE-2026-19730Medium 4.2

  Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives

  Affected: all versions.

  No fix released. The latest release, v2.2.1, is still affected.

• CVE-2026-55686Medium 5.3

  Podman: WORKDIR symlink traversal vulnerability

  Affected: all versions.

  No fix released. The latest release, v2.2.1, is still affected.

• CVE-2026-57231High 7.5

  Podman: Malformed Image can trick podman run into leaking host environment variables into the container

  Affected: through 2.2.1; all versions.

  No fix released. The latest release, v2.2.1, is still affected.

• CVE-2026-33414Medium 4.0

  PowerShell Command Injection in Podman HyperV Machine

  Affected: all versions.

  No fix released. The latest release, v2.2.1, is still affected.

• CVE-2025-4953High 7.4

  Podman: build context bind mount

  Affected: all versions.

  No fix released. The latest release, v2.2.1, is still affected.

• CVE-2025-9566High 8.1

  Podman: podman kube play command may overwrite host files

  Affected: all versions.

  No fix released. The latest release, v2.2.1, is still affected.

• CVE-2025-6032High 8.3

  Podman: podman missing tls verification

  Affected: all versions.

  No fix released. The latest release, v2.2.1, is still affected.

• CVE-2024-9407Medium 4.7

  Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction

  Affected: fixed in 5.2.4; all versions.

  No fix released. The latest release, v2.2.1, is still affected.

• CVE-2024-3056High 7.7

  Podman: kernel: containers in shared ipc namespace are vulnerable to denial of service attack

  Affected: through 5.2.0; all versions.

  No fix released. The latest release, v2.2.1, is still affected.

• CVE-2022-4122Medium 5.3

  A vulnerability was found in buildah.

  Affected: all versions.

  No fix released. The latest release, v2.2.1, is still affected.

• CVE-2022-27649Unrated

  A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions.

  Affected: all versions.

  No fix released. The latest release, v2.2.1, is still affected.

• CVE-2021-4024Unrated

  A flaw was found in podman.

  Affected: all versions.

  No fix released. The latest release, v2.2.1, is still affected.

• CVE-2020-14370Unrated

  An information disclosure vulnerability was found in containers/podman in versions before 2.0.5.

  Affected: fixed in 2.0.5.

  Fixed in v2.1.0 (released Sep 22, 2020, 1 day before disclosure, the advisory names 2.0.5, which was never published).

  The latest release, v2.2.1, is not affected.

• CVE-2020-1726Medium 5.9

  A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they…

  Affected: fixed in 2.0.6.

  Fixed in v2.1.0 (released Sep 22, 2020, 224 days after disclosure, the advisory names 2.0.6, which was never published).

  The latest release, v2.2.1, is not affected.