CVE-2018-10856: Podman Elevated Container Privileges
Summary
CVE-2018-10856: Podman Elevated Container Privileges. Affects github.com/containers/podman versions < 0.6.1. Fixed in 0.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Podman is an open-source container engine that allows users to manage and run containers on Linux systems. It provides a command-line interface and API for creating, starting, stopping, and managing containers. The vulnerability identified as CVE-2018-10856 affects Podman versions prior to 0.6.1. This vulnerability allows containers to retain unnecessary privileges when executed as a non-root user, potentially leading to unauthorized access and privilege escalation within the container.
Vulnerability Detail
The vulnerability in Podman arises from the failure to drop capabilities when running containers as non-root users. As a result, containers are granted unnecessary privileges, which can be exploited by malicious actors to gain unauthorized access or escalate privileges within the container. This vulnerability poses a significant security risk as it allows an attacker to perform actions within the container that should be restricted to privileged users. The Common Vulnerabilities and Exposures (CVE) identifier for this vulnerability is CVE-2018-10856.
How To Fix
Latest published version: v1.4.2 as of 22 Oct 2026
go get github.com/containers/podman@v1.4.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.6.1
This is the first release that contains the fix.
go get github.com/containers/podman@v0.6.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually drop capabilities within the container by modifying the container configuration. This can be achieved by specifying the desired capabilities using the --cap-drop flag when running the container. For example, to drop the SYS_ADMIN capability, the following command can be used: podman run --cap-drop SYS_ADMIN <image>. However, applying this workaround requires manual intervention and may not be feasible in all scenarios.
Conclusion
In conclusion, the CVE-2018-10856 vulnerability in Podman allows containers to retain unnecessary privileges when executed as non-root users. This can be exploited by attackers to gain unauthorized access or escalate privileges within the container. To mitigate this vulnerability, it is crucial to update Podman to version 0.6.1 or later. Regularly updating all software components is also recommended to ensure the latest security patches are applied. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/containers/podman →
FAQ
Podman is an open-source container engine that allows users to manage and run containers on Linux systems. It provides a command-line interface and API for creating, starting, stopping, and managing containers.
The vulnerability allows containers to retain unnecessary privileges when executed as a non-root user. This can be exploited by attackers to gain unauthorized access or escalate privileges within the container, potentially leading to further compromise of the system.
To fix the vulnerability, it is recommended to update Podman to version 0.6.1 or later. This version includes the necessary changes to drop capabilities when executing containers as non-root users.
A workaround involves manually dropping capabilities within the container by modifying the container configuration. This can be achieved by specifying the desired capabilities using the --cap-drop flag when running the container.
Yes, the CVSS score for CVE-2018-10856 is 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containers/podman.
