There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file.
Binary-Affected: podman Upstream-version-introduced: v4.0.0 Upstream-version-fixed: v5.6.1
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade crunUpgrade containernetworking-pluginsUpgrade python3-criuUpgrade podman-remoteUpgrade runcUpgrade podman-testsUpgrade container-selinuxUpgrade libslirp-develUpgrade criu-develUpgrade podman-dockerUpgrade podman-pluginsUpgrade skopeo-testsUpgrade critUpgrade udicaUpgrade podman-catatonitUpgrade skopeoUpgrade toolboxUpgrade aardvark-dnsUpgrade podmanUpgrade buildahUpgrade python3-podmanUpgrade cockpit-podmanUpgrade toolbox-testsUpgrade libslirpUpgrade containers-commonUpgrade podman-gvproxyUpgrade fuse-overlayfsUpgrade netavarkUpgrade criu-libsUpgrade buildah-testsUpgrade oci-seccomp-bpf-hookUpgrade criuUpgrade slirp4netnsUpgrade conmon | Sep 18, 2025 | Sep 16, 2025 |
| Alpine Linux | — | Upgrade podman | Sep 8, 2025 | Sep 5, 2025 |
| Oracle_linux | — | Upgrade podman-gvproxyUpgrade cockpit-podmanUpgrade podman-testsUpgrade podman-remoteUpgrade podman-dockerUpgrade containers-commonUpgrade libslirp-develUpgrade libslirpUpgrade aardvark-dnsUpgrade python3-criuUpgrade skopeo-testsUpgrade buildah-testsUpgrade criu-libsUpgrade critUpgrade slirp4netnsUpgrade oci-seccomp-bpf-hookUpgrade criu-develUpgrade container-selinuxUpgrade podman-catatonitUpgrade fuse-overlayfsUpgrade containernetworking-pluginsUpgrade podmanUpgrade conmonUpgrade criuUpgrade netavarkUpgrade python3-podmanUpgrade udicaUpgrade crunUpgrade buildahUpgrade podman-pluginsUpgrade skopeoUpgrade runc | Sep 18, 2025 | Sep 4, 2025 |
| Redhat Openshift | — | Upgrade openshiftUpgrade kernel-rtUpgrade podmanUpgrade container-selinuxUpgrade rhcosUpgrade cri-oUpgrade kernelUpgrade openshift-ansible | Aug 10, 2026 | Sep 4, 2025 |
| Redhat_linux | — | Upgrade criu-libs-debuginfoUpgrade slirp4netnsUpgrade toolboxUpgrade slirp4netns-debugsourceUpgrade criu-develUpgrade python3-criuUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-plugins-debuginfoUpgrade podman-tests-debuginfoUpgrade container-selinuxUpgrade skopeoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade runc-debuginfoUpgrade podman-pluginsUpgrade udicaUpgrade crunUpgrade critUpgrade buildah-debugsourceUpgrade podman-dockerUpgrade slirp4netns-debuginfoUpgrade runcUpgrade libslirp-debugsourceUpgrade podman-debuginfoUpgrade libslirp-debuginfoUpgrade podman-gvproxyUpgrade podman-catatonit-debuginfoUpgrade toolbox-debuginfoUpgrade podman-debugsourceUpgrade podman-remote-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade skopeo-testsUpgrade podman-testsUpgrade toolbox-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade conmonUpgrade libslirpUpgrade podman-remoteUpgrade buildah-debuginfoUpgrade aardvark-dnsUpgrade criuUpgrade podmanUpgrade netavarkUpgrade fuse-overlayfs-debugsourceUpgrade criu-debugsourceUpgrade containernetworking-pluginsUpgrade cockpit-podmanUpgrade python3-podmanUpgrade crun-debuginfoUpgrade crun-debugsourceUpgrade podman-catatonitUpgrade criu-debuginfoUpgrade buildah-tests-debuginfoUpgrade libslirp-develUpgrade buildahUpgrade toolbox-testsUpgrade conmon-debugsourceUpgrade buildah-testsUpgrade containers-commonUpgrade conmon-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfs-debuginfoUpgrade runc-debugsourceUpgrade criu-libsUpgrade fuse-overlayfs | Sep 17, 2025 | Sep 4, 2025 |
| Rocky_linux | — | Upgrade criu-debuginfoUpgrade python3-criuUpgrade libslirp-develUpgrade libslirp-debuginfoUpgrade buildahUpgrade toolbox-testsUpgrade podman-gvproxy-debuginfoUpgrade buildah-debuginfoUpgrade containers-commonUpgrade containernetworking-pluginsUpgrade fuse-overlayfs-debugsourceUpgrade criuUpgrade oci-seccomp-bpf-hookUpgrade runcUpgrade conmon-debuginfoUpgrade conmon-debugsourceUpgrade runc-debugsourceUpgrade aardvark-dnsUpgrade criu-libsUpgrade podman-remoteUpgrade crun-debugsourceUpgrade buildah-tests-debuginfoUpgrade fuse-overlayfsUpgrade criu-debugsourceUpgrade podman-plugins-debuginfoUpgrade podman-debuginfoUpgrade buildah-testsUpgrade podman-catatonitUpgrade runc-debuginfoUpgrade critUpgrade podman-pluginsUpgrade buildah-debugsourceUpgrade libslirp-debugsourceUpgrade toolbox-debugsourceUpgrade podman-catatonit-debuginfoUpgrade podman-testsUpgrade libslirpUpgrade slirp4netns-debugsourceUpgrade podmanUpgrade toolbox-debuginfoUpgrade conmonUpgrade podman-gvproxyUpgrade podman-debugsourceUpgrade toolboxUpgrade crunUpgrade skopeo-testsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade skopeoUpgrade podman-remote-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade crun-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade podman-tests-debuginfoUpgrade slirp4netnsUpgrade slirp4netns-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade criu-libs-debuginfoUpgrade netavarkUpgrade criu-develUpgrade containernetworking-plugins-debuginfo | Feb 5, 2026 | Nov 29, 2025 |
| Suse | — | Upgrade podman-dockerUpgrade podmanUpgrade podman-remoteUpgrade podmansh | Dec 5, 2025 | Sep 17, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 17, 2026 | Sep 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub