What the history shows
The software has 17 documented CVEs with a maximum CVSS score of 8.8 and 0 known exploited vulnerabilities in the KEV catalog.
How to stay safe
Operators should maintain deployments on supported release lines such as 6.1 and regularly track installed versions.
Check your version
podman --versionAffected version lines
- 6.0 1 CVEs End of life
- 5.8 2 CVEs End of life
- 5.7 3 CVEs End of life
- 5.2 4 CVEs End of life
- 4.8 4 CVEs End of life
- 4.3 5 CVEs End of life
- 4.2 4 CVEs End of life
- 4.1 4 CVEs End of life
- 4.0 4 CVEs End of life
- 3.4 6 CVEs End of life
- 3.3 6 CVEs End of life
- 3.0 5 CVEs End of life
- 2.0 6 CVEs
- 1.8 6 CVEs
- 1.7 4 CVEs
- 1.6 7 CVEs
- 1.5 6 CVEs
Known vulnerabilities
| CVE | Title | Affected versions | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|---|
| CVE-2026-55686 | Podman: WORKDIR symlink traversal vulnerability | ≥ 3.0.0 < 5.7.1 | 5.3 | — | 2026-06-27 | |
| CVE-2026-57231 | Podman: Malformed Image can trick podman run into leaking host environment variables into the container | ≥ 1.8.1 < 5.8.4 = 6.0.0 | 7.5 | — | 2026-06-27 | |
| CVE-2026-33414 | PowerShell Command Injection in Podman HyperV Machine | ≥ 4.8.0 < 5.8.2 | 4.0 | — | 2026-04-15 | |
| CVE-2024-3056 | Podman: kernel: containers in shared ipc namespace are vulnerable to denial of service attack | ≤ 5.2.0 | 7.7 | — | 2024-08-03 | |
| CVE-2023-0778 | A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replac... | * | 6.8 | — | 2023-03-27 | |
| CVE-2022-4122 | A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dock... | = 4.3.0 | 5.3 | — | 2022-12-08 | |
| CVE-2022-4123 | A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect abso... | = 4.1.0 = 4.1.1 = 4.2.0 | 3.3 | — | 2022-12-08 | |
| CVE-2022-2989 | An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive i... | * | 7.1 | — | 2022-09-13 | |
| CVE-2022-2739 | The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included a... | = 1.6.4-32.el7_9 | 5.3 | — | 2022-09-02 | |
| CVE-2022-2738 | The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included a... | = 1.6.4-32.el7_9 | 7.5 | — | 2022-09-02 | |
| CVE-2019-25067 | Podman/Varlink API Privilege Escalation | = 1.5.1 | 6.3 | — | 2022-06-09 | |
| CVE-2022-1227 | A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to... | < 4.0.0 | 8.8 | — | 2022-04-30 | |
| CVE-2022-27649 | A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vu... | < 4.0.3 | 7.5 | — | 2022-04-05 | |
| CVE-2021-4024 | A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine co... | ≥ 3.3.0 < 3.4.3 | 6.5 | — | 2021-12-24 | |
| CVE-2021-20188 | A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container... | < 1.7.0 | 7.0 | — | 2021-02-12 | |
| CVE-2021-20199 | Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from... | ≥ 1.8.0 < 3.0.0 | 5.9 | — | 2021-02-03 | |
| CVE-2020-14370 | An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using th... | < 2.0.5 | 5.3 | — | 2020-09-23 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).