github.com/containers/podman/v2 (Go) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Go package github.com/containers/podman/v2, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (14)

• CVE-2025-6032 — CVSS 8.3 (high): A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI…
• CVE-2025-9566 — CVSS 8.1 (high): There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a…
• CVE-2026-33414 — CVSS 7.8 (high): Podman is a tool for managing OCI containers and pods. Versions 4.8.0 through 5.8.1 contain a command injection vulnerability in the HyperV…
• CVE-2024-3056 — CVSS 7.7 (high): A flaw was found in Podman. This issue may allow an attacker to create a specially crafted container that, when configured to share the…
• CVE-2022-27649 — CVSS 7.5 (high): A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby…
• CVE-2025-4953 — CVSS 7.4 (high): A flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not…
• CVE-2021-4024 — CVSS 6.5 (medium): A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process)…
• CVE-2020-1726 — CVSS 5.9 (medium): A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they…
• CVE-2019-18466 — CVSS 5.5 (medium): An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during a copy operation from the…
• CVE-2026-55686 — CVSS 5.3 (medium): Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path…
• CVE-2020-14370 — CVSS 5.3 (medium): An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or…
• CVE-2022-4122 — CVSS 5.3 (medium): A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in…
• CVE-2018-10856 — CVSS 5.3 (medium): It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This…
• CVE-2024-9407 — CVSS 4.7 (medium): A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the…