CVE-2021-20188: Improper Authorization in github.com/containers/libpod
Summary
CVE-2021-20188: Improper Authorization in github.com/containers/libpod. Affects github.com/containers/libpod versions < 1.7.0. Fixed in 1.7.0. How to fix ↓
Also tracked for
- libpod · Debian:11
The same CVE-2021-20188 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/containers/libpod is a Go package that provides a library for managing pods, containers, and container images. It is commonly used in container runtime environments. The package allows users to create and manage containers, including setting up file permissions and access controls. However, a vulnerability has been discovered in versions prior to 1.7.0 that allows non-root users running in a privileged container to bypass file permissions and access any file in the container, even if owned by the root user. This can lead to unauthorized access to sensitive data and compromise the integrity of the system.
Vulnerability Detail
The vulnerability (CVE-2021-20188) in github.com/containers/libpod arises from improper authorization checks for file permissions in privileged containers. Non-root users inside the container can exploit this flaw to access any file, regardless of ownership. Although direct escape from the container is not possible, the compromised privileged container poses a significant risk to data confidentiality, integrity, and system availability. The vulnerability has a CVSS score of 7.0, indicating a high severity level.
How To Fix
Latest published version: v1.9.3 as of 22 Oct 2026
go get github.com/containers/libpod@v1.9.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.7.0
This is the first release that contains the fix.
go get github.com/containers/libpod@v1.7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of github.com/containers/libpod as soon as possible.
Conclusion
The vulnerability in github.com/containers/libpod (CVE-2021-20188) allows non-root users in privileged containers to bypass file permissions and access any file within the container. Upgrading to version 1.7.0 or later of the package is necessary to address this vulnerability and prevent unauthorized access. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/containers/libpod →
FAQ
The vulnerability allows non-root users in privileged containers to access any file, compromising data confidentiality and integrity, as well as system availability.
No, direct escape from the container is not possible. However, the compromised privileged container can still pose a significant risk.
The CVSS score of this vulnerability is 7.0, indicating a high severity level.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
To fix this vulnerability, upgrade to version 1.7.0 or later of github.com/containers/libpod.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containers/libpod.
