# github.com/containers/podman/v4 (Go) vulnerabilities 18 known vulnerabilities (1 critical, 7 high, 7 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v4.9.5 (May 30, 2024): affected by 13 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 52 since v4.0.0 (Feb 17, 2022) - Registry: https://pkg.go.dev/github.com/containers/podman/v4 - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-94603: v4.4.0 to v4.9.5 (through the newest release) - CVE-2026-19730: v4.0.0-rc2 to v4.9.5 (through the newest release) - CVE-2026-55686: v4.0.0-rc2 to v4.9.5 (through the newest release) - CVE-2026-57231: v4.0.0-rc2 to v4.9.5 (through the newest release) - CVE-2026-33414: v4.8.0 to v4.9.5 (through the newest release) - CVE-2025-4953: v4.0.0-rc2 to v4.9.5 (through the newest release) - CVE-2025-9566: v4.0.0-rc2 to v4.9.5 (through the newest release) - CVE-2025-6032: v4.8.0 to v4.9.5 (through the newest release) - CVE-2024-9407: v4.0.0-rc2 to v4.9.5 (through the newest release) - CVE-2024-3056: v4.0.0-rc2 to v4.9.5 (through the newest release) - CVE-2024-1753: v4.0.0-rc2 to v4.9.3 (v4.9.4 is outside it) - CVE-2023-0778: v4.0.0-rc2 to v4.4.1 (v4.4.2 is outside it) - CVE-2022-4123: v4.1.0-rc1 to v4.9.5 (through the newest release) - CVE-2022-4122: v4.0.0-rc2 to v4.5.0-rc2 (v4.5.0 is outside it) - CVE-2022-2989: v4.0.0-rc2 to v4.2.0-rc3 (v4.2.0 is outside it) - CVE-2022-27649: v4.0.0-rc2 to v4.0.2 (v4.0.3 is outside it) - CVE-2019-18466: v4.0.0-rc2 to v4.9.5 (through the newest release) - CVE-2018-10856: v4.0.0-rc2 to v4.9.5 (through the newest release) ## Advisories (18) ### [CVE-2026-94603](https://cve.now/CVE-2026-94603): Podman: The \`podman run\` command can be instructed to disable almost all sandboxing by image annotation - Severity: Critical 10.0 - Published: Oct 13, 2026 - Affected: from 4.4.0, fixed in 5.8.8; from 4.4.0. - No fix released. The latest release, v4.9.5, is still affected. ### [CVE-2026-19730](https://cve.now/CVE-2026-19730): Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives - Severity: Medium 4.2 - Published: Aug 13, 2026 - Affected: all versions. - No fix released. The latest release, v4.9.5, is still affected. ### [CVE-2026-55686](https://cve.now/CVE-2026-55686): Podman: WORKDIR symlink traversal vulnerability - Severity: Medium 5.3 - Published: Jun 26, 2026 - Affected: through 4.9.5. - No fix released. The latest release, v4.9.5, is still affected. ### [CVE-2026-57231](https://cve.now/CVE-2026-57231): Podman: Malformed Image can trick podman run into leaking host environment variables into the container - Severity: High 7.5 - Published: Jun 26, 2026 - Affected: through 4.9.5; all versions. - No fix released. The latest release, v4.9.5, is still affected. ### [CVE-2026-33414](https://cve.now/CVE-2026-33414): PowerShell Command Injection in Podman HyperV Machine - Severity: Medium 4.0 - Published: Apr 14, 2026 - Affected: from 4.8.0, through 4.9.5; from 4.8.0. - No fix released. The latest release, v4.9.5, is still affected. ### [CVE-2025-4953](https://cve.now/CVE-2025-4953): Podman: build context bind mount - Severity: High 7.4 - Published: Sep 16, 2025 - Affected: all versions. - No fix released. The latest release, v4.9.5, is still affected. ### [CVE-2025-9566](https://cve.now/CVE-2025-9566): Podman: podman kube play command may overwrite host files - Severity: High 8.1 - Published: Sep 5, 2025 - Affected: through 4.9.5; all versions. - No fix released. The latest release, v4.9.5, is still affected. ### [CVE-2025-6032](https://cve.now/CVE-2025-6032): Podman: podman missing tls verification - Severity: High 8.3 - Published: Jun 24, 2025 - Affected: from 4.8.0, through 4.9.5; from 4.8.0. - No fix released. The latest release, v4.9.5, is still affected. ### [CVE-2024-9407](https://cve.now/CVE-2024-9407): Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction - Severity: Medium 4.7 - Published: Oct 1, 2024 - Affected: fixed in 5.2.4; all versions. - No fix released. The latest release, v4.9.5, is still affected. ### [CVE-2024-3056](https://cve.now/CVE-2024-3056): Podman: kernel: containers in shared ipc namespace are vulnerable to denial of service attack - Severity: High 7.7 - Published: Aug 2, 2024 - Affected: through 5.2.0; all versions. - No fix released. The latest release, v4.9.5, is still affected. ### [CVE-2024-1753](https://cve.now/CVE-2024-1753): Buildah: buildah: container escape via improper bind mount validation - Severity: High 8.6 - Published: Mar 18, 2024 - Affected: fixed in 4.9.4. - Fixed in v4.9.4 (released Mar 25, 2024, 7 days after disclosure). - The latest release, v4.9.5, is not affected. ### [CVE-2023-0778](https://cve.now/CVE-2023-0778): A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. - Severity: Medium 6.8 - Published: Mar 27, 2023 - Affected: fixed in 4.4.2. - Fixed in v4.4.2 (released Feb 23, 2023, 32 days before disclosure). - The latest release, v4.9.5, is not affected. ### [CVE-2022-4123](https://cve.now/CVE-2022-4123): A flaw was found in Buildah. - Severity: Low 3.3 - Published: Dec 8, 2022 - Affected: from 4.1.0-rc1; from 4.1.0-rc1, through 4.4.1. - No fix released. The latest release, v4.9.5, is still affected. ### [CVE-2022-4122](https://cve.now/CVE-2022-4122): A vulnerability was found in buildah. - Severity: Medium 5.3 - Published: Dec 8, 2022 - Affected: fixed in 4.5.0. - Fixed in v4.5.0 (released Apr 14, 2023, 127 days after disclosure). - The latest release, v4.9.5, is not affected. ### [CVE-2022-2989](https://cve.now/CVE-2022-2989): An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or… - Severity: High 7.1 - Published: Sep 13, 2022 - Affected: fixed in 4.2.0. - Fixed in v4.2.0 (released Aug 10, 2022, 34 days before disclosure). - The latest release, v4.9.5, is not affected. ### [CVE-2022-27649](https://cve.now/CVE-2022-27649): A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. - Severity: Unrated - Published: Apr 4, 2022 - Affected: fixed in 4.0.3. - Fixed in v4.0.3 (released Apr 1, 2022, 3 days before disclosure). - The latest release, v4.9.5, is not affected. ### [CVE-2019-18466](https://cve.now/CVE-2019-18466): An issue was discovered in Podman in libpod before 1.6.0. - Severity: Unrated - Published: Oct 28, 2019 - Affected: all versions; fixed in 1.6.0. - No fix released. The latest release, v4.9.5, is still affected. ### [CVE-2018-10856](https://cve.now/CVE-2018-10856): It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. - Severity: Medium 5.3 - Published: Jul 2, 2018 - Affected: all versions. - No fix released. The latest release, v4.9.5, is still affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/containers/podman/v4 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.