# github.com/containers/podman (Go) vulnerabilities Source: https://junglewise.ai/threats/technologies/github-com-containers-podman Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/github-com-containers-podman.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 17 vulnerabilities in github.com/containers/podman (Go): 0 in the last 7 days and 1 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-94603, was published on 13 October 2026. 1 vulnerability in the last four weeks, up from none in the four before. 1 critical against 0. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 1 - All time: 17 (1 critical, 0 exploited in the wild) ## About github.com/containers/podman (Go) Podman is a container runtime for building, running, and managing OCI containers and pods. ## Latest github.com/containers/podman (Go) vulnerabilities - [CVE-2026-94603: Podman sandbox bypass via checkpoint image annotation](https://junglewise.ai/threats/cve-2026-94603-podman-the-podman-run-command-can-be-instructed-to-disable-almost) (critical, CVSS 10, published 13 Oct 2026) - [CVE-2026-19730: Podman quadlet install incomplete file truncation](https://junglewise.ai/threats/cve-2026-19730-podman-quadlet-install-incomplete-file-truncation) (medium, CVSS 4.2, published 13 Aug 2026) - [CVE-2026-57231: Podman host environment variable leak via malformed container image](https://junglewise.ai/threats/cve-2026-57231-podman-host-environment-variable-leak-via-malformed-container) (high, CVSS 7.5, published 26 Jun 2026) - [CVE-2026-55686: Podman symlink traversal in WORKDIR path resolution](https://junglewise.ai/threats/cve-2026-55686-podman-symlink-traversal-in-workdir-path-resolution) (medium, CVSS 5.3, published 26 Jun 2026) - [CVE-2026-33414: Podman command injection in HyperV machine backend](https://junglewise.ai/threats/cve-2026-33414-podman-command-injection-in-hyperv-machine-backend) (high, CVSS 7.8, published 14 Apr 2026) - [CVE-2025-4953: Podman data persistence in bind mounts during build](https://junglewise.ai/threats/cve-2025-4953-podman-data-persistence-in-bind-mounts-during-build) (high, CVSS 7.4, published 16 Sep 2025) - [CVE-2025-9566: Podman path traversal host file overwrite in kube play](https://junglewise.ai/threats/cve-2025-9566-podman-path-traversal-host-file-overwrite-in-kube-play) (high, CVSS 8.1, published 5 Sep 2025) - [CVE-2025-6032: GO-2025-3777 - Podman Improper Certificate Validation; machine missing TLS verification in github.com/containers/podman](https://junglewise.ai/threats/cve-2025-6032-podman-improper-certificate-validation-machine-missing-tls) (low, CVSS 3.1, published 28 Jul 2025) - [CVE-2024-9407: GO-2024-3169 - Improper Input Validation in Buildah and Podman in github.com/containers/buildah](https://junglewise.ai/threats/cve-2024-9407-improper-input-validation-in-buildah-and-podman) (low, CVSS 3.1, published 9 Oct 2024) - [CVE-2022-4122: GO-2022-1151 - Buildah (as part of Podman) vulnerable to Link Following in github.com/containers/podman](https://junglewise.ai/threats/cve-2022-4122-buildah-as-part-of-podman-vulnerable-to-link-following) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2022-27649: GO-2022-0416 - Podman's default inheritable capabilities for linux container not empty in github.com/containers/podman](https://junglewise.ai/threats/cve-2022-27649-podman-s-default-inheritable-capabilities-for-linux-container-not) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2021-4024: Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman](https://junglewise.ai/threats/cve-2021-4024-exposure-of-sensitive-information-to-an-unauthorized-actor-and) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2018-10856: GO-2023-1962 - Podman Elevated Container Privileges in github.com/containers/podman](https://junglewise.ai/threats/cve-2018-10856-podman-elevated-container-privileges) (low, CVSS 3, published 20 Aug 2024) - [CVE-2019-10152: GO-2023-1927 - Podman Path Traversal Vulnerability leads to arbitrary file read/write in github.com/containers/podman](https://junglewise.ai/threats/cve-2019-10152-podman-path-traversal-vulnerability-leads-to-arbitrary-file-read) (low, CVSS 3.1, published 20 Aug 2024) - [CVE-2019-18466: GO-2023-1942 - Podman Symlink Vulnerability in github.com/containers/libpod](https://junglewise.ai/threats/cve-2019-18466-podman-symlink-vulnerability) (low, CVSS 3.1, published 20 Aug 2024) - [CVE-2020-1726: GO-2023-1544 - Podman has Files or Directories Accessible to External Parties in github.com/containers/libpod](https://junglewise.ai/threats/cve-2020-1726-podman-has-files-or-directories-accessible-to-external-parties) (low, CVSS 3.1, published 20 Aug 2024) - [CVE-2024-3056: GO-2024-3042 - Podman vulnerable to memory-based denial of service in github.com/containers/podman](https://junglewise.ai/threats/cve-2024-3056-podman-vulnerable-to-memory-based-denial-of-service) (low, CVSS 3.1, published 6 Aug 2024) ## Most severe github.com/containers/podman (Go) vulnerabilities - [CVE-2026-94603: Podman sandbox bypass via checkpoint image annotation](https://junglewise.ai/threats/cve-2026-94603-podman-the-podman-run-command-can-be-instructed-to-disable-almost) (critical, CVSS 10, published 13 Oct 2026) - [CVE-2025-9566: Podman path traversal host file overwrite in kube play](https://junglewise.ai/threats/cve-2025-9566-podman-path-traversal-host-file-overwrite-in-kube-play) (high, CVSS 8.1, published 5 Sep 2025) - [CVE-2026-33414: Podman command injection in HyperV machine backend](https://junglewise.ai/threats/cve-2026-33414-podman-command-injection-in-hyperv-machine-backend) (high, CVSS 7.8, published 14 Apr 2026) - [CVE-2026-57231: Podman host environment variable leak via malformed container image](https://junglewise.ai/threats/cve-2026-57231-podman-host-environment-variable-leak-via-malformed-container) (high, CVSS 7.5, published 26 Jun 2026) - [CVE-2025-4953: Podman data persistence in bind mounts during build](https://junglewise.ai/threats/cve-2025-4953-podman-data-persistence-in-bind-mounts-during-build) (high, CVSS 7.4, published 16 Sep 2025) - [CVE-2026-55686: Podman symlink traversal in WORKDIR path resolution](https://junglewise.ai/threats/cve-2026-55686-podman-symlink-traversal-in-workdir-path-resolution) (medium, CVSS 5.3, published 26 Jun 2026) - [CVE-2026-19730: Podman quadlet install incomplete file truncation](https://junglewise.ai/threats/cve-2026-19730-podman-quadlet-install-incomplete-file-truncation) (medium, CVSS 4.2, published 13 Aug 2026) - [CVE-2020-1726: GO-2023-1544 - Podman has Files or Directories Accessible to External Parties in github.com/containers/libpod](https://junglewise.ai/threats/cve-2020-1726-podman-has-files-or-directories-accessible-to-external-parties) (low, CVSS 3.1, published 20 Aug 2024) - [CVE-2019-18466: GO-2023-1942 - Podman Symlink Vulnerability in github.com/containers/libpod](https://junglewise.ai/threats/cve-2019-18466-podman-symlink-vulnerability) (low, CVSS 3.1, published 20 Aug 2024) - [CVE-2022-27649: GO-2022-0416 - Podman's default inheritable capabilities for linux container not empty in github.com/containers/podman](https://junglewise.ai/threats/cve-2022-27649-podman-s-default-inheritable-capabilities-for-linux-container-not) (low, CVSS 3.1, published 21 Aug 2024) ## Vulnerabilities per week 1 vulnerability in the last four weeks, up from none in the four before. 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 1 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Go technologies - [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server): 297 vulnerabilities - [github.com/mattermost/mattermost-server/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6): 222 vulnerabilities - [github.com/mattermost/mattermost/server/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8): 207 vulnerabilities - [github.com/mattermost/mattermost-server/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5): 199 vulnerabilities - [stdlib (Go)](https://junglewise.ai/threats/technologies/go-stdlib): 178 vulnerabilities - [github.com/siyuan-note/siyuan/kernel (Go)](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel): 160 vulnerabilities - [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea): 126 vulnerabilities - [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api): 91 vulnerabilities - [gogs.io/gogs (Go)](https://junglewise.ai/threats/technologies/gogs-io-gogs): 81 vulnerabilities - [github.com/traefik/traefik/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2): 78 vulnerabilities - [github.com/traefik/traefik (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik): 75 vulnerabilities - [github.com/usememos/memos (Go)](https://junglewise.ai/threats/technologies/github-com-usememos-memos): 75 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "github.com/containers/podman (Go) vulnerabilities", https://junglewise.ai/threats/technologies/github-com-containers-podman, 13 November 2026.