Podman Elevated Container Privileges

published 2018-07-02 8 y ago modified 2026-06-17 4 mo ago also GHSA-wp7w-vx86-vj9h , GO-2023-1962 , EUVD-2022-5613

cvss: 5.3; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.9%; EPSS 0.9% chance of exploitation in 30 days, percentile 58%
public exploits: 0; none known

It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This results in unnecessary privileges being granted to the container.

Patch / fix

fixed in 2 distros 2 links 1

go github.com/containers/podman 0.6.1
libpod_project libpod 0.6.1

red hat opensuse

podman RHEL 7 EXTRAS_OTHER 0.6.1-3.git3e0ff12.el7

red hat advisories RHSA-2018:2037

podman openSUSE Tumbleweed 3.3.1-2.1

opensuse advisories openSUSE-SU-2024:11177-1

github.com/projectatomic/libpod@bae80a0 commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-10856 updated 2026-11-07 cvss 5.3

podman: Containers run as non-root users do not drop capabilities

Red Hat Enterprise Linux 7 Extras podman 0.6.1-3.git3e0ff12.el7
fixed: vendor fix RHSA-2018:2037
Red Hat Enterprise Linux 8 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +2 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.86% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.0	5.3	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
NVD	3.0	8.8	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P
GitHub	3.0	8.8	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
go	github.com/containers/podman	<0.6.1	0.6.1
go	github.com/containers/podman/v2	all versions	no fix listed
go	github.com/containers/podman/v3	all versions	no fix listed
go	github.com/containers/podman/v4	all versions	no fix listed

Affected products

[UNKNOWN] podman

Classification

Weakness

CWE-250 Execution with Unnecessary Privileges
CWE-732 Incorrect Permission Assignment for Critical Resource

References

github.com /projectatomic/libpod/commit/bae80a0b663925ec751ad2784ca32989403cdc24
web, patch, third-party-advisory
access.redhat.com /errata/RHSA-2018:2037
vendor-advisory, web, third-party-advisory
bugzilla.redhat.com /show_bug.cgi?id=CVE-2018-10856
web, issue-tracking, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2018-10856
advisory
github.com /containers/podman
package
github.com /advisories/GHSA-wp7w-vx86-vj9h
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary