github.com/containers/podman/v5

Podman: A tool for managing OCI containers and pods.

View on Go

View on Github

Activity

Latest release: 1mo ago
Total releases: 20
Cadence: ~20 days
Last 12 months: 13

Reach

Stars: 32.8k

Details

First release: Jun 05, 2025

Releases

Version	Released
`v5.8.6` patch 2 CVEs	Aug 13, 2026
`v5.8.5` patch 2 CVEs	Jul 08, 2026
`v5.8.4` patch 2 CVEs	Jun 25, 2026
`v5.8.3` patch 2 CVEs	Jun 12, 2026
`v5.8.2` patch 2 CVEs	Apr 13, 2026
`v5.8.1` patch 3 CVEs	Mar 11, 2026
`v5.8.0` minor 3 CVEs	Feb 12, 2026
`v5.8.0-rc1` pre 3 CVEs	Feb 10, 2026
`v5.7.1` patch 3 CVEs	Dec 09, 2025
`v5.7.0` minor 4 CVEs	Nov 11, 2025
`v5.7.0-rc3` pre 4 CVEs	Nov 05, 2025
`v5.7.0-rc2` pre 4 CVEs	Oct 29, 2025
`v5.7.0-rc1` pre 4 CVEs	Oct 24, 2025
`v5.6.2` patch 4 CVEs	Sep 30, 2025
`v5.6.1` patch 4 CVEs	Sep 04, 2025
`v5.6.0` minor 5 CVEs	Aug 15, 2025
`v5.6.0-rc2` pre 5 CVEs	Aug 08, 2025
`v5.6.0-rc1` pre 5 CVEs	Jul 25, 2025
`v5.5.2` patch 5 CVEs	Jun 24, 2025
`v5.5.1` initial 6 CVEs	Jun 05, 2025

Repository

containers/podman

Forks: 3.4k
Open issues: 935
Language: Go
: 7.8/ 10

containers
docker
kubernetes
linux
oci

Dependencies (72)

Depends on

v5.8.6

Used by

Supply-chain exposure

66 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Vulnerable dependencies

2 of 72

github.com/containers/buildah 1 CVE
golang.org/x/crypto 1 CVE

These dependencies are still vulnerable in their latest release. Whether the exact version this package pins is affected isn't checked yet.

Known CVEs (8)

CVE-2026-55686 GO-2026-5568 GHSA-q6r4-3wmg-fwcq Jun 25, 2026

Podman: WORKDIR symlink traversal vulnerability in github.com/containers/podman

Podman: WORKDIR symlink traversal vulnerability in github.com/containers/podman

Fixed in

5.7.1

References

https://github.com/podman-container-tools/podman/security/advisories/GHSA-q6r4-3wmg-fwcq
https://github.com/podman-container-tools/podman/commit/7ce2e00ab140c11a68301f0b161f51984131a858
https://github.com/podman-container-tools/podman/commit/d18e44e9abb3bf5b7294aa70806e1368fdddfdd0

Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-33414 GO-2026-5421 GHSA-hc8w-h2mf-hp59 Jun 25, 2026

PowerShell Command Injection in Podman HyperV Machine in github.com/containers/podman

PowerShell Command Injection in Podman HyperV Machine in github.com/containers/podman

Fixed in

5.8.2

References

https://github.com/containers/podman/security/advisories/GHSA-hc8w-h2mf-hp59
https://nvd.nist.gov/vuln/detail/CVE-2026-33414
https://github.com/containers/podman/commit/571c842bd357ee626019ea97d030fb772fc654ed

Updated Jun 25, 2026 · Source: OSV.dev
CVE-2025-4953 GO-2025-3961 GHSA-m68q-4hqr-mc6f Sep 17, 2025

Podman Creates Temporary File with Insecure Permissions in github.com/containers/podman

Podman Creates Temporary File with Insecure Permissions in github.com/containers/podman

References

https://github.com/advisories/GHSA-m68q-4hqr-mc6f
https://nvd.nist.gov/vuln/detail/CVE-2025-4953
https://access.redhat.com/security/cve/CVE-2025-4953
https://bugzilla.redhat.com/show_bug.cgi?id=2367235

Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-9566 GO-2025-3935 GHSA-wp3j-xq48-xpjw Sep 08, 2025

podman kube play symlink traversal vulnerability in github.com/containers/podman

podman kube play symlink traversal vulnerability in github.com/containers/podman

Fixed in

5.6.1

References

https://github.com/containers/podman/security/advisories/GHSA-wp3j-xq48-xpjw
https://github.com/containers/podman/commit/43fbde4e665fe6cee6921868f04b7ccd3de5ad89

Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-6032 GO-2025-3777 GHSA-65gg-3w2w-hr4h Jul 28, 2025

Podman Improper Certificate Validation; machine missing TLS verification in github.com/containers/podman

Podman Improper Certificate Validation; machine missing TLS verification in github.com/containers/podman

Fixed in

5.5.2

References

https://github.com/containers/podman/security/advisories/GHSA-65gg-3w2w-hr4h
https://nvd.nist.gov/vuln/detail/CVE-2025-6032
https://github.com/containers/podman/commit/726b506acc8a00d99f1a3a1357ecf619a1f798c3
https://access.redhat.com/errata/RHSA-2025:10295
https://access.redhat.com/errata/RHSA-2025:10549
https://access.redhat.com/errata/RHSA-2025:10550

Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407 GO-2024-3169 GHSA-fhqq-8f65-5xfc Oct 09, 2024

Improper Input Validation in Buildah and Podman in github.com/containers/buildah

Improper Input Validation in Buildah and Podman in github.com/containers/buildah

Fixed in

5.2.4

References

https://github.com/advisories/GHSA-fhqq-8f65-5xfc
https://github.com/containers/buildah/commit/e4e2ad5ca2088d7c388109394135ead7aaf1f4f4
https://github.com/containers/podman/releases/tag/v5.2.4

Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-3056 GO-2024-3042 GHSA-rpcc-p8xm-rc6p Aug 06, 2024

Podman vulnerable to memory-based denial of service in github.com/containers/podman

Podman vulnerable to memory-based denial of service in github.com/containers/podman

References

https://github.com/advisories/GHSA-rpcc-p8xm-rc6p
https://nvd.nist.gov/vuln/detail/CVE-2024-3056
https://access.redhat.com/security/cve/CVE-2024-3056
https://bugzilla.redhat.com/show_bug.cgi?id=2270717

Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-1753 GHSA-874v-pj72-92f3 GHSA-pmf3-c36m-g5cf GO-2024-2658 Mar 28, 2024

Podman affected by CVE-2024-1753 container escape at build time

Medium
Local Low None

Impact

What kind of vulnerability is it? Who is impacted?

Users running containers with root privileges allowing a container to run with read/write access to the host system files when selinux is not enabled. With selinux enabled, some read access is allowed.

Patches

From @nalind . This is a patch for Buildah (https://github.com/containers/buildah). Once fixed there, Buildah will be vendored into Podman.

# cat /root/cve-2024-1753.diff --- internal/volumes/volumes.go +++ internal/volumes/volumes.go @@ -11,6 +11,7 @@ import ( "errors" + "github.com/containers/buildah/copier" "github.com/containers/buildah/define" "github.com/containers/buildah/internal" internalParse "github.com/containers/buildah/internal/parse" @@ -189,7 +190,11 @@ func GetBindMount(ctx *types.SystemContext, args []string, contextDir string, st // buildkit parity: support absolute path for sources from current build context if contextDir != "" { // path should be /contextDir/specified path - newMount.Source = filepath.Join(contextDir, filepath.Clean(string(filepath.Separator)+newMount.Source)) + evaluated, err := copier.Eval(contextDir, newMount.Source, copier.EvalOptions{}) + if err != nil { + return newMount, "", err + } + newMount.Source = evaluated } else { // looks like its coming from `build run --mount=type=bind` allow using absolute path // error out if no source is set

Reproducer

Prior to testing, as root, add a memorable username to /etc/passwd via adduser or your favorite editor. Also create a memorably named file in /. Suggest: touch /SHOULDNTSEETHIS.txt and adduser SHOULDNTSEETHIS. After testing, remember to remove both the file and the user from your system.

Use the following Containerfile

# cat ~/cve_Containerfile FROM alpine as base RUN ln -s / /rootdir RUN ln -s /etc /etc2 FROM alpine RUN echo "ls container root" RUN ls -l / RUN echo "With exploit show host root, not the container's root, and create /BIND_BREAKOUT in / on the host" RUN --mount=type=bind,from=base,source=/rootdir,destination=/exploit,rw ls -l /exploit; touch /exploit/BIND_BREAKOUT; ls -l /exploit RUN echo "With exploit show host /etc/passwd, not the container's, and create /BIND_BREAKOUT2 in /etc on the host" RUN --mount=type=bind,rw,source=/etc2,destination=/etc2,from=base ls -l /; ls -l /etc2/passwd; cat /etc2/passwd; touch /etc2/BIND_BREAKOUT2; ls -l /etc2

To Test

Testing with an older version of Podman with the issue

setenforce 0 podman build -f ~/cve_Containerfile .

As part of the printout from the build, you should be able to see the contents of the /' and /etcdirectories, including the/SHOULDNOTSEETHIS.txtfile that you created, and the contents of the/etc/passwdfile which will include theSHOULDNOTSEETHISuser that you created. In addition, the file/BIND_BREAKOUTand/etc/BIND_BREAKOUT2` will exist on the host after the command is completed. Be sure to remove those two files between tests.

podman rm -a podman rmi -a rm /BIND_BREAKOUT rm /etc/BIND_BREAKOUT2 setenforce 1 podman build -f ~/cve_Containerfile .

Neither the /BIND_BREAKEOUT or /etc/BIND_BREAKOUT2 files should be created. An error should be raised during the build when both files are trying to be created. Also, errors will be raised when the build tries to display the contents of the /etc/passwd file, and nothing will be displayed from that file.

However, the files in both the / and /etc directories on the host system will be displayed.

Testing with the patch

Use the same commands as testing with an older version of Podman.

When running using the patched version of Podman, regardless of the setenforce settings, you should not see the file that you created or the user that you added. Also the /BIND_BREAKOUT and the /etc/BIND_BREAKOUT will not exist on the host after the test completes.

NOTE: With the fix, the contents of the / and /etc directories, and the /etc/passwd file will be displayed, however, it will be the file and contents from the container image, and NOT the host system. Also the /BIND_BREAKOUT and /etc/BIND_BREAKOUT files will be created in the container image.

Workarounds

Ensure selinux controls are in place to avoid compromising sensitive system files and systems. With "setenforce 0" set, which is not at all advised, the root file system is open for modification with this exploit. With "setenfoce 1" set, which is the recommendation, files can not be changed. However, the contents of the / directory can be displayed. I.e., ls -alF / will show the contents of the host directory.

References

Unknown.

Fixed in

5.0.1

References

https://github.com/containers/podman/security/advisories/GHSA-874v-pj72-92f3
https://github.com/containers/buildah/security/advisories/GHSA-pmf3-c36m-g5cf
https://nvd.nist.gov/vuln/detail/CVE-2024-1753
https://pkg.go.dev/vuln/GO-2024-2658
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZVBSVZGVABPYIHK5HZM472NPGWMI7WXH
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KOYMVMQ7RWMDTSKQTBO734BE3WQPI2AJ

Updated Sep 10, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

minor 3
patch 10
pre 6

20 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More