# github.com/containers/podman/v2 (Go) vulnerabilities 17 known vulnerabilities (1 critical, 5 high, 7 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v2.2.1 (Dec 7, 2020): affected by 15 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 8 since v2.1.0 (Sep 22, 2020) - Registry: https://pkg.go.dev/github.com/containers/podman/v2 - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-94603: v2.1.0-rc1 to v2.2.1 (through the newest release) - CVE-2026-19730: v2.1.0-rc1 to v2.2.1 (through the newest release) - CVE-2026-55686: v2.1.0-rc1 to v2.2.1 (through the newest release) - CVE-2026-57231: v2.1.0-rc1 to v2.2.1 (through the newest release) - CVE-2026-33414: v2.1.0-rc1 to v2.2.1 (through the newest release) - CVE-2025-4953: v2.1.0-rc1 to v2.2.1 (through the newest release) - CVE-2025-9566: v2.1.0-rc1 to v2.2.1 (through the newest release) - CVE-2025-6032: v2.1.0-rc1 to v2.2.1 (through the newest release) - CVE-2024-9407: v2.1.0-rc1 to v2.2.1 (through the newest release) - CVE-2024-3056: v2.1.0-rc1 to v2.2.1 (through the newest release) - CVE-2022-4122: v2.1.0-rc1 to v2.2.1 (through the newest release) - CVE-2022-27649: v2.1.0-rc1 to v2.2.1 (through the newest release) - CVE-2021-4024: v2.1.0-rc1 to v2.2.1 (through the newest release) - CVE-2020-14370: no published release is affected - CVE-2020-1726: no published release is affected - CVE-2019-18466: v2.1.0-rc1 to v2.2.1 (through the newest release) - CVE-2018-10856: v2.1.0-rc1 to v2.2.1 (through the newest release) ## Advisories (17) ### [CVE-2026-94603](https://cve.now/CVE-2026-94603): Podman: The \`podman run\` command can be instructed to disable almost all sandboxing by image annotation - Severity: Critical 10.0 - Published: Oct 13, 2026 - Affected: all versions. - No fix released. The latest release, v2.2.1, is still affected. ### [CVE-2026-19730](https://cve.now/CVE-2026-19730): Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives - Severity: Medium 4.2 - Published: Aug 13, 2026 - Affected: all versions. - No fix released. The latest release, v2.2.1, is still affected. ### [CVE-2026-55686](https://cve.now/CVE-2026-55686): Podman: WORKDIR symlink traversal vulnerability - Severity: Medium 5.3 - Published: Jun 26, 2026 - Affected: all versions. - No fix released. The latest release, v2.2.1, is still affected. ### [CVE-2026-57231](https://cve.now/CVE-2026-57231): Podman: Malformed Image can trick podman run into leaking host environment variables into the container - Severity: High 7.5 - Published: Jun 26, 2026 - Affected: through 2.2.1; all versions. - No fix released. The latest release, v2.2.1, is still affected. ### [CVE-2026-33414](https://cve.now/CVE-2026-33414): PowerShell Command Injection in Podman HyperV Machine - Severity: Medium 4.0 - Published: Apr 14, 2026 - Affected: all versions. - No fix released. The latest release, v2.2.1, is still affected. ### [CVE-2025-4953](https://cve.now/CVE-2025-4953): Podman: build context bind mount - Severity: High 7.4 - Published: Sep 16, 2025 - Affected: all versions. - No fix released. The latest release, v2.2.1, is still affected. ### [CVE-2025-9566](https://cve.now/CVE-2025-9566): Podman: podman kube play command may overwrite host files - Severity: High 8.1 - Published: Sep 5, 2025 - Affected: all versions. - No fix released. The latest release, v2.2.1, is still affected. ### [CVE-2025-6032](https://cve.now/CVE-2025-6032): Podman: podman missing tls verification - Severity: High 8.3 - Published: Jun 24, 2025 - Affected: all versions. - No fix released. The latest release, v2.2.1, is still affected. ### [CVE-2024-9407](https://cve.now/CVE-2024-9407): Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction - Severity: Medium 4.7 - Published: Oct 1, 2024 - Affected: fixed in 5.2.4; all versions. - No fix released. The latest release, v2.2.1, is still affected. ### [CVE-2024-3056](https://cve.now/CVE-2024-3056): Podman: kernel: containers in shared ipc namespace are vulnerable to denial of service attack - Severity: High 7.7 - Published: Aug 2, 2024 - Affected: through 5.2.0; all versions. - No fix released. The latest release, v2.2.1, is still affected. ### [CVE-2022-4122](https://cve.now/CVE-2022-4122): A vulnerability was found in buildah. - Severity: Medium 5.3 - Published: Dec 8, 2022 - Affected: all versions. - No fix released. The latest release, v2.2.1, is still affected. ### [CVE-2022-27649](https://cve.now/CVE-2022-27649): A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. - Severity: Unrated - Published: Apr 4, 2022 - Affected: all versions. - No fix released. The latest release, v2.2.1, is still affected. ### [CVE-2021-4024](https://cve.now/CVE-2021-4024): A flaw was found in podman. - Severity: Unrated - Published: Dec 23, 2021 - Affected: all versions. - No fix released. The latest release, v2.2.1, is still affected. ### [CVE-2020-14370](https://cve.now/CVE-2020-14370): An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. - Severity: Unrated - Published: Sep 23, 2020 - Affected: fixed in 2.0.5. - Fixed in v2.1.0 (released Sep 22, 2020, 1 day before disclosure, the advisory names 2.0.5, which was never published). - The latest release, v2.2.1, is not affected. ### [CVE-2020-1726](https://cve.now/CVE-2020-1726): A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they… - Severity: Medium 5.9 - Published: Feb 11, 2020 - Affected: fixed in 2.0.6. - Fixed in v2.1.0 (released Sep 22, 2020, 224 days after disclosure, the advisory names 2.0.6, which was never published). - The latest release, v2.2.1, is not affected. ### [CVE-2019-18466](https://cve.now/CVE-2019-18466): An issue was discovered in Podman in libpod before 1.6.0. - Severity: Unrated - Published: Oct 28, 2019 - Affected: all versions. - No fix released. The latest release, v2.2.1, is still affected. ### [CVE-2018-10856](https://cve.now/CVE-2018-10856): It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. - Severity: Medium 5.3 - Published: Jul 2, 2018 - Affected: all versions. - No fix released. The latest release, v2.2.1, is still affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/containers/podman/v2 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.