There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file.
Binary-Affected: podman Upstream-version-introduced: v4.0.0 Upstream-version-fixed: v5.6.1
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libslirpUpgrade toolboxUpgrade containers-commonUpgrade skopeoUpgrade buildahUpgrade fuse-overlayfsUpgrade slirp4netnsUpgrade podmanUpgrade netavarkUpgrade cockpit-podmanUpgrade podman-gvproxyUpgrade aardvark-dnsUpgrade buildah-testsUpgrade criu-libsUpgrade criuUpgrade oci-seccomp-bpf-hookUpgrade conmonUpgrade podman-catatonitUpgrade toolbox-testsUpgrade python3-podmanUpgrade criu-develUpgrade runcUpgrade container-selinuxUpgrade crunUpgrade libslirp-develUpgrade podman-dockerUpgrade udicaUpgrade skopeo-testsUpgrade podman-testsUpgrade podman-pluginsUpgrade containernetworking-pluginsUpgrade python3-criuUpgrade critUpgrade podman-remote | Sep 18, 2025 | Sep 16, 2025 |
| Alpine Linux | — | Upgrade podman | Sep 8, 2025 | Sep 5, 2025 |
| Oracle_linux | — | Upgrade python3-podmanUpgrade podmanUpgrade skopeoUpgrade podman-pluginsUpgrade criuUpgrade netavarkUpgrade udicaUpgrade podman-catatonitUpgrade conmonUpgrade buildahUpgrade fuse-overlayfsUpgrade crunUpgrade containernetworking-pluginsUpgrade runcUpgrade critUpgrade podman-gvproxyUpgrade podman-dockerUpgrade criu-develUpgrade container-selinuxUpgrade containers-commonUpgrade libslirpUpgrade libslirp-develUpgrade podman-remoteUpgrade cockpit-podmanUpgrade skopeo-testsUpgrade podman-testsUpgrade aardvark-dnsUpgrade buildah-testsUpgrade python3-criuUpgrade oci-seccomp-bpf-hookUpgrade criu-libsUpgrade slirp4netns | Sep 18, 2025 | Sep 4, 2025 |
| Redhat Openshift | — | Upgrade rhcosUpgrade cri-oUpgrade openshift-ansibleUpgrade kernelUpgrade container-selinuxUpgrade openshiftUpgrade podmanUpgrade kernel-rt | Aug 10, 2026 | Sep 4, 2025 |
| Redhat_linux | — | Upgrade containernetworking-plugins-debuginfoUpgrade podman-plugins-debuginfoUpgrade podman-remoteUpgrade skopeoUpgrade podman-catatonit-debuginfoUpgrade podman-dockerUpgrade podman-debugsourceUpgrade libslirp-debugsourceUpgrade podman-debuginfoUpgrade libslirp-debuginfoUpgrade runc-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade slirp4netns-debuginfoUpgrade toolboxUpgrade runcUpgrade udicaUpgrade container-selinuxUpgrade libslirpUpgrade critUpgrade skopeo-testsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-pluginsUpgrade podman-gvproxyUpgrade slirp4netnsUpgrade podman-testsUpgrade toolbox-debuginfoUpgrade buildah-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade criu-libs-debuginfoUpgrade toolbox-debugsourceUpgrade conmonUpgrade crunUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-remote-debuginfoUpgrade criu-develUpgrade podman-tests-debuginfoUpgrade python3-criuUpgrade slirp4netns-debugsourceUpgrade crun-debugsourceUpgrade buildahUpgrade podmanUpgrade containers-commonUpgrade conmon-debuginfoUpgrade python3-podmanUpgrade fuse-overlayfs-debuginfoUpgrade cockpit-podmanUpgrade buildah-debuginfoUpgrade podman-catatonitUpgrade criu-debuginfoUpgrade buildah-tests-debuginfoUpgrade runc-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade criu-debugsourceUpgrade containernetworking-pluginsUpgrade crun-debuginfoUpgrade aardvark-dnsUpgrade fuse-overlayfsUpgrade toolbox-testsUpgrade libslirp-develUpgrade conmon-debugsourceUpgrade buildah-testsUpgrade oci-seccomp-bpf-hookUpgrade netavarkUpgrade criu-libsUpgrade criu | Sep 17, 2025 | Sep 4, 2025 |
| Rocky_linux | — | Upgrade buildah-debuginfoUpgrade buildahUpgrade libslirp-develUpgrade python3-criuUpgrade runc-debugsourceUpgrade podman-catatonitUpgrade containernetworking-pluginsUpgrade podman-gvproxy-debuginfoUpgrade podman-debuginfoUpgrade conmon-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade buildah-testsUpgrade aardvark-dnsUpgrade fuse-overlayfsUpgrade buildah-tests-debuginfoUpgrade podman-remoteUpgrade criu-debugsourceUpgrade runcUpgrade toolbox-testsUpgrade podman-plugins-debuginfoUpgrade crun-debugsourceUpgrade containers-commonUpgrade criuUpgrade oci-seccomp-bpf-hookUpgrade criu-libsUpgrade criu-debuginfoUpgrade libslirp-debuginfoUpgrade conmon-debugsourceUpgrade podmanUpgrade libslirp-debugsourceUpgrade criu-libs-debuginfoUpgrade criu-develUpgrade containernetworking-plugins-debuginfoUpgrade buildah-debugsourceUpgrade podman-remote-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade podman-tests-debuginfoUpgrade crun-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade slirp4netns-debuginfoUpgrade slirp4netnsUpgrade fuse-overlayfs-debuginfoUpgrade crunUpgrade skopeoUpgrade podman-pluginsUpgrade toolboxUpgrade skopeo-testsUpgrade podman-gvproxyUpgrade podman-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade critUpgrade slirp4netns-debugsourceUpgrade toolbox-debuginfoUpgrade runc-debuginfoUpgrade podman-testsUpgrade libslirpUpgrade conmonUpgrade toolbox-debugsourceUpgrade podman-catatonit-debuginfoUpgrade netavark | Feb 5, 2026 | Nov 29, 2025 |
| Suse | — | Upgrade podmanshUpgrade podman-remoteUpgrade podman-dockerUpgrade podman | Dec 5, 2025 | Sep 17, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 17, 2026 | Sep 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub