# github.com/containers/podman/v3 (Go) vulnerabilities

18 known vulnerabilities (1 critical, 6 high, 6 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pkg.go.dev/github.com/containers/podman/v3

## Advisories (18)

### [CVE-2026-94603](https://cve.now/CVE-2026-94603): Podman: The \`podman run\` command can be instructed to disable almost all sandboxing by image annotation

- Severity: Critical 10.0
- Published: Oct 13, 2026
- Affected: all versions.

### [CVE-2026-19730](https://cve.now/CVE-2026-19730): Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives

- Severity: Medium 4.2
- Published: Aug 13, 2026
- Affected: all versions.

### [CVE-2026-55686](https://cve.now/CVE-2026-55686): Podman: WORKDIR symlink traversal vulnerability

- Severity: Medium 5.3
- Published: Jun 26, 2026
- Affected: through 3.4.7.

### [CVE-2026-57231](https://cve.now/CVE-2026-57231): Podman: Malformed Image can trick podman run into leaking host environment variables into the container

- Severity: High 7.5
- Published: Jun 26, 2026
- Affected: through 3.4.7; all versions.

### [CVE-2026-33414](https://cve.now/CVE-2026-33414): PowerShell Command Injection in Podman HyperV Machine

- Severity: Medium 4.0
- Published: Apr 14, 2026
- Affected: all versions.

### [CVE-2025-4953](https://cve.now/CVE-2025-4953): Podman: build context bind mount

- Severity: High 7.4
- Published: Sep 16, 2025
- Affected: all versions.

### [CVE-2025-9566](https://cve.now/CVE-2025-9566): Podman: podman kube play command may overwrite host files

- Severity: High 8.1
- Published: Sep 5, 2025
- Affected: all versions.

### [CVE-2025-6032](https://cve.now/CVE-2025-6032): Podman: podman missing tls verification

- Severity: High 8.3
- Published: Jun 24, 2025
- Affected: all versions.

### [CVE-2024-9407](https://cve.now/CVE-2024-9407): Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction

- Severity: Medium 4.7
- Published: Oct 1, 2024
- Affected: fixed in 5.2.4; all versions.

### [CVE-2024-3056](https://cve.now/CVE-2024-3056): Podman: kernel: containers in shared ipc namespace are vulnerable to denial of service attack

- Severity: High 7.7
- Published: Aug 2, 2024
- Affected: through 5.2.0; all versions.

### [CVE-2022-4122](https://cve.now/CVE-2022-4122): A vulnerability was found in buildah.

- Severity: Medium 5.3
- Published: Dec 8, 2022
- Affected: all versions.

### [CVE-2022-2989](https://cve.now/CVE-2022-2989): An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or…

- Severity: High 7.1
- Published: Sep 13, 2022
- Affected: fixed in 3.0.1.

### [CVE-2022-1227](https://cve.now/CVE-2022-1227): A privilege escalation flaw was found in Podman.

- Severity: Unrated
- Published: Apr 29, 2022
- Affected: fixed in 3.4.

### [CVE-2022-27649](https://cve.now/CVE-2022-27649): A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions.

- Severity: Unrated
- Published: Apr 4, 2022
- Affected: all versions.

### [CVE-2021-4024](https://cve.now/CVE-2021-4024): A flaw was found in podman.

- Severity: Unrated
- Published: Dec 23, 2021
- Affected: fixed in 3.4.3.

### [CVE-2021-20199](https://cve.now/CVE-2021-20199): Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts).

- Severity: Unrated
- Published: Feb 2, 2021
- Affected: fixed in 3.0.0.

### [CVE-2019-18466](https://cve.now/CVE-2019-18466): An issue was discovered in Podman in libpod before 1.6.0.

- Severity: Unrated
- Published: Oct 28, 2019
- Affected: all versions.

### [CVE-2018-10856](https://cve.now/CVE-2018-10856): It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user.

- Severity: Medium 5.3
- Published: Jul 2, 2018
- Affected: all versions.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/github.com/containers/podman/v3
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.