By vendor

Podman_project vulnerabilities

Known CVEs affecting Podman_project products, prioritized by severity, with SEC.co remediation and detection guidance.

2 published vulnerabilities

• CVE-2026-57231HIGH 7.5

  Podman, a widely-used container management tool, has a vulnerability that allows a malicious container image to steal sensitive environment variables from the host system where the container runs. By crafting an image with improperly formatted environment variables—particularly using wildcard characters—an attacker can exfiltrate all environment variables accessible to the Podman session, potentially exposing credentials, API keys, and other secrets. The flaw affects versions 1.8.1 through 5.8.4 and is resolved in version 5.8.4 and later, as well as in version 6.0.0 and beyond.

• CVE-2026-55686MEDIUM 5.3

  Podman, a widely-used container management tool, contains a symlink-handling vulnerability that allows a malicious container image to create directories or modify file ownership on the host system. The flaw exists in versions 3.0.0 through 5.7.0 and has been patched in version 5.7.1. An attacker would need to craft a container with a symlink in the WORKDIR path; modifying ownership requires additional coordination with a compromised host process during a race condition window, making that outcome less probable but still possible.