- Latest release
- v5.8.9 (Oct 12, 2026): affected by 2 advisories
- Newest unaffected release
- Every release is affected by at least one advisory
- Advisories
- 11 · 1 critical, 6 high, 4 medium
- Releases
- 62 since v5.0.0 (Mar 19, 2024)
- Registry
- pkg.go.dev
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-94603Affects v5.0.0-rc1 to v5.8.7 (v5.8.8 is outside it)
- CVE-2026-19730Affects v5.7.0 to v5.8.5 (v5.8.6 is outside it)
- CVE-2026-55686Affects v5.0.0-rc1 to v5.7.0 (v5.7.1 is outside it)
- CVE-2026-57231Affects v5.0.0-rc1 to v5.8.3 (v5.8.4 is outside it)
- CVE-2026-33414Affects v5.0.0-rc1 to v5.8.1 (v5.8.2 is outside it)
- CVE-2025-4953Affects v5.0.0-rc1 to v5.8.9 (through the newest release)
- CVE-2025-9566Affects v5.0.0-rc1 to v5.6.0 (v5.6.1 is outside it)
- CVE-2025-6032Affects v5.0.0-rc1 to v5.5.1 (v5.5.2 is outside it)
- CVE-2024-9407Affects v5.0.0-rc1 to v5.2.3 (v5.2.4 is outside it)
- CVE-2024-3056Affects v5.0.0-rc1 to v5.8.9 (through the newest release)
- CVE-2024-1753Affects v5.0.0-rc1 to v5.0.0 (v5.0.1 is outside it)
Advisories 11
- CVE-2026-94603Critical 10.0
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
Affected: from 4.4.0, fixed in 5.8.8; fixed in 5.8.8.
Fixed in v5.8.8 (released Sep 29, 2026, 14 days before disclosure).
The latest release, v5.8.9, is not affected.
- CVE-2026-19730Medium 4.2
Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives
Affected: from 5.7.0, fixed in 5.8.6.
Fixed in v5.8.6 (released Aug 13, 2026, the day of disclosure).
The latest release, v5.8.9, is not affected.
- CVE-2026-55686Medium 5.3
Podman: WORKDIR symlink traversal vulnerability
Affected: fixed in 5.7.1.
Fixed in v5.7.1 (released Dec 9, 2025, 199 days before disclosure).
The latest release, v5.8.9, is not affected.
- CVE-2026-57231High 7.5
Podman: Malformed Image can trick podman run into leaking host environment variables into the container
Affected: fixed in 5.8.4.
Fixed in v5.8.4 (released Jun 25, 2026, 1 day before disclosure).
The latest release, v5.8.9, is not affected.
- CVE-2026-33414Medium 4.0
PowerShell Command Injection in Podman HyperV Machine
Affected: fixed in 5.8.2.
Fixed in v5.8.2 (released Apr 13, 2026, 1 day before disclosure).
The latest release, v5.8.9, is not affected.
- CVE-2025-4953High 7.4
Podman: build context bind mount
Affected: through 5.5.0; all versions.
No fix released. The latest release, v5.8.9, is still affected.
- CVE-2025-9566High 8.1
Podman: podman kube play command may overwrite host files
Affected: fixed in 5.6.1.
Fixed in v5.6.1 (released Sep 4, 2025, 1 day before disclosure).
The latest release, v5.8.9, is not affected.
- CVE-2025-6032High 8.3
Podman: podman missing tls verification
Affected: fixed in 5.5.2.
Fixed in v5.5.2 (released Jun 24, 2025, the day of disclosure).
The latest release, v5.8.9, is not affected.
- CVE-2024-9407Medium 4.7
Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction
Affected: fixed in 5.2.4.
Fixed in v5.2.4 (released Oct 7, 2024, 6 days after disclosure).
The latest release, v5.8.9, is not affected.
- CVE-2024-3056High 7.7
Podman: kernel: containers in shared ipc namespace are vulnerable to denial of service attack
Affected: through 5.2.0; all versions.
No fix released. The latest release, v5.8.9, is still affected.
- CVE-2024-1753High 8.6
Buildah: buildah: container escape via improper bind mount validation
Affected: fixed in 5.0.1.
Fixed in v5.0.1 (released Apr 1, 2024, 14 days after disclosure).
The latest release, v5.8.9, is not affected.