podman
v6.2.0Podman: A tool for managing OCI containers and pods.
- Maintenance
- Active672 commits in 3 months · bus factor 3
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 11 advisories1 critical, 4 high, 4 medium, 2 low
- Supported versions
- 1 line supportednewest 6.1 · 11 ended
33.3k stars · 3.5k forks · 1k open issues · last release 4 days ago · data checked 2 hours ago
Security advisories
All advisories on GitHubThe 11 most recent advisories published by the maintainers: 1 critical, 4 high, 4 medium, 2 low. Check the patched version against the one you run.
- mediumCVE-2026-121885Nov 10, 2026The `podman auto-update` may restart arbitrary systemd units based from the image labels
- Affected
- >= v1.8.2, <v6.2.0; >= v1.8.2, <v5.8.10
- Patched in
- v6.2.0; v5.8.10
- criticalCVE-2026-94603Sep 29, 2026The `podman run` command can be instructed to disable almost all sandboxing - including user-requested sandboxing - by image annotation
- Affected
- >= v4.4.0
- Patched in
- v5.8.8; v6.1.3
- mediumCVE-2026-19730Aug 13, 2026podman quadlet install --replace does not fully replace the old file
- Affected
- >= 5.7.0; None
- Patched in
- v5.8.6; v6.0.0
- highCVE-2026-57231Jun 24, 2026Malformed Image can trick podman run into leaking host environment variables into the container
- Affected
- >= v1.8.1, <= v5.8.3; < v6.0.0
- Patched in
- v5.8.4; v6.0.0
- mediumCVE-2026-55686Jun 17, 2026WORKDIR symlink traversal vulnerability
- Affected
- >= v3.0.0, <= v5.7.0
- Patched in
- v5.7.1
- lowCVE-2026-33414Apr 14, 2026PowerShell Command Injection in Podman HyperV Machine
- Affected
- >= v4.8.0, <= v5.8.1
- Patched in
- v5.8.2
- highCVE-2025-9566Sep 4, 2025podman kube play symlink traversal vulnerability
- Affected
- v4.0.0 to v5.6.0
- Patched in
- v5.6.1
- highCVE-2025-6032Jun 24, 2025podman machine missing TLS verification
- Affected
- v4.8.0 to v5.5.1
- Patched in
- v5.5.2
- mediumGHSA-34xh-hvp7-r2j7May 12, 2025Supply Chain vulnerability in containers/podman machine-os GitHub Actions workflow
- Affected
- none
- highCVE-2024-1753Mar 18, 2024CVE-2024-1753 container escape at build time
- Affected
- Podman v4.0->v4.9.3, and v5.0
- Patched in
- v4.9.4, v5.0.1.
- lowCVE-2022-27649Apr 1, 2022Default inheritable capabilities for linux container should be empty
- Affected
- all
- Patched in
- 4.0.3