# github.com/containers/podman/v5 (Go) vulnerabilities 11 known vulnerabilities (1 critical, 6 high, 4 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v5.8.9 (Oct 12, 2026): affected by 2 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 62 since v5.0.0 (Mar 19, 2024) - Registry: https://pkg.go.dev/github.com/containers/podman/v5 - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-94603: v5.0.0-rc1 to v5.8.7 (v5.8.8 is outside it) - CVE-2026-19730: v5.7.0 to v5.8.5 (v5.8.6 is outside it) - CVE-2026-55686: v5.0.0-rc1 to v5.7.0 (v5.7.1 is outside it) - CVE-2026-57231: v5.0.0-rc1 to v5.8.3 (v5.8.4 is outside it) - CVE-2026-33414: v5.0.0-rc1 to v5.8.1 (v5.8.2 is outside it) - CVE-2025-4953: v5.0.0-rc1 to v5.8.9 (through the newest release) - CVE-2025-9566: v5.0.0-rc1 to v5.6.0 (v5.6.1 is outside it) - CVE-2025-6032: v5.0.0-rc1 to v5.5.1 (v5.5.2 is outside it) - CVE-2024-9407: v5.0.0-rc1 to v5.2.3 (v5.2.4 is outside it) - CVE-2024-3056: v5.0.0-rc1 to v5.8.9 (through the newest release) - CVE-2024-1753: v5.0.0-rc1 to v5.0.0 (v5.0.1 is outside it) ## Advisories (11) ### [CVE-2026-94603](https://cve.now/CVE-2026-94603): Podman: The \`podman run\` command can be instructed to disable almost all sandboxing by image annotation - Severity: Critical 10.0 - Published: Oct 13, 2026 - Affected: from 4.4.0, fixed in 5.8.8; fixed in 5.8.8. - Fixed in v5.8.8 (released Sep 29, 2026, 14 days before disclosure). - The latest release, v5.8.9, is not affected. ### [CVE-2026-19730](https://cve.now/CVE-2026-19730): Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives - Severity: Medium 4.2 - Published: Aug 13, 2026 - Affected: from 5.7.0, fixed in 5.8.6. - Fixed in v5.8.6 (released Aug 13, 2026, the day of disclosure). - The latest release, v5.8.9, is not affected. ### [CVE-2026-55686](https://cve.now/CVE-2026-55686): Podman: WORKDIR symlink traversal vulnerability - Severity: Medium 5.3 - Published: Jun 26, 2026 - Affected: fixed in 5.7.1. - Fixed in v5.7.1 (released Dec 9, 2025, 199 days before disclosure). - The latest release, v5.8.9, is not affected. ### [CVE-2026-57231](https://cve.now/CVE-2026-57231): Podman: Malformed Image can trick podman run into leaking host environment variables into the container - Severity: High 7.5 - Published: Jun 26, 2026 - Affected: fixed in 5.8.4. - Fixed in v5.8.4 (released Jun 25, 2026, 1 day before disclosure). - The latest release, v5.8.9, is not affected. ### [CVE-2026-33414](https://cve.now/CVE-2026-33414): PowerShell Command Injection in Podman HyperV Machine - Severity: Medium 4.0 - Published: Apr 14, 2026 - Affected: fixed in 5.8.2. - Fixed in v5.8.2 (released Apr 13, 2026, 1 day before disclosure). - The latest release, v5.8.9, is not affected. ### [CVE-2025-4953](https://cve.now/CVE-2025-4953): Podman: build context bind mount - Severity: High 7.4 - Published: Sep 16, 2025 - Affected: through 5.5.0; all versions. - No fix released. The latest release, v5.8.9, is still affected. ### [CVE-2025-9566](https://cve.now/CVE-2025-9566): Podman: podman kube play command may overwrite host files - Severity: High 8.1 - Published: Sep 5, 2025 - Affected: fixed in 5.6.1. - Fixed in v5.6.1 (released Sep 4, 2025, 1 day before disclosure). - The latest release, v5.8.9, is not affected. ### [CVE-2025-6032](https://cve.now/CVE-2025-6032): Podman: podman missing tls verification - Severity: High 8.3 - Published: Jun 24, 2025 - Affected: fixed in 5.5.2. - Fixed in v5.5.2 (released Jun 24, 2025, the day of disclosure). - The latest release, v5.8.9, is not affected. ### [CVE-2024-9407](https://cve.now/CVE-2024-9407): Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction - Severity: Medium 4.7 - Published: Oct 1, 2024 - Affected: fixed in 5.2.4. - Fixed in v5.2.4 (released Oct 7, 2024, 6 days after disclosure). - The latest release, v5.8.9, is not affected. ### [CVE-2024-3056](https://cve.now/CVE-2024-3056): Podman: kernel: containers in shared ipc namespace are vulnerable to denial of service attack - Severity: High 7.7 - Published: Aug 2, 2024 - Affected: through 5.2.0; all versions. - No fix released. The latest release, v5.8.9, is still affected. ### [CVE-2024-1753](https://cve.now/CVE-2024-1753): Buildah: buildah: container escape via improper bind mount validation - Severity: High 8.6 - Published: Mar 18, 2024 - Affected: fixed in 5.0.1. - Fixed in v5.0.1 (released Apr 1, 2024, 14 days after disclosure). - The latest release, v5.8.9, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/containers/podman/v5 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.