github.com/containers/podman/v5 (Go) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Go package github.com/containers/podman/v5, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (8)

• CVE-2024-1753 — CVSS 8.6 (high): A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem…
• CVE-2025-6032 — CVSS 8.3 (high): A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI…
• CVE-2025-9566 — CVSS 8.1 (high): There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a…
• CVE-2026-33414 — CVSS 7.8 (high): Podman is a tool for managing OCI containers and pods. Versions 4.8.0 through 5.8.1 contain a command injection vulnerability in the HyperV…
• CVE-2024-3056 — CVSS 7.7 (high): A flaw was found in Podman. This issue may allow an attacker to create a specially crafted container that, when configured to share the…
• CVE-2025-4953 — CVSS 7.4 (high): A flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not…
• CVE-2026-55686 — CVSS 5.3 (medium): Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path…
• CVE-2024-9407 — CVSS 4.7 (medium): A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the…