CVE-2021-4024: Exposure of Sensitive Information and Origin Validation Error in podman
Summary
CVE-2021-4024: Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman. Affects github.com/containers/podman/v3 versions < 3.4.3. Fixed in 3.4.3. How to fix ↓
Also tracked for
- github.com/containers/podman · Go
- libpod · Debian:12
The same CVE-2021-4024 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Podman is an open-source container engine that allows users to manage containers and container images. It provides a command-line interface (CLI) for creating, running, and managing containers. The podman machine function is used to create and manage a Podman virtual machine that contains a Podman process. This virtual machine can be used to isolate containers and provide a secure environment for running them. However, a vulnerability has been discovered in podman that exposes sensitive information to unauthorized actors and allows origin validation errors.
Vulnerability Detail
The vulnerability in podman arises from the podman machine function spawning a gvproxy process on the host system. The gvproxy API is accessible on port 7777 on all IP addresses on the host. If this port is open on the host's firewall, an attacker can potentially use the gvproxy API to forward ports on the host to ports in the virtual machine, making private services on the virtual machine accessible to the network. This can lead to unauthorized access to sensitive information and also disrupt the host's services by forwarding all ports to the virtual machine.
How To Fix
Latest published version: v3.4.7 as of 22 Oct 2026
go get github.com/containers/podman/v3@v3.4.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.3
This is the first release that contains the fix.
go get github.com/containers/podman/v3@v3.4.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating podman is not immediately possible, a workaround is to manually close port 7777 on the host's firewall. By blocking access to the gvproxy API, the risk of unauthorized access and exposure of sensitive information can be reduced. The specific steps to close the port may vary depending on the host's operating system and firewall configuration.
Conclusion
In conclusion, the vulnerability in podman exposes sensitive information to unauthorized actors and allows them to access private services on the virtual machine. It is recommended to update podman to version 3.4.3 or later to mitigate this vulnerability. If immediate updating is not possible, manually closing port 7777 on the host's firewall can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/containers/podman/v3 →
FAQ
Podman is an open-source container engine that allows users to manage containers and container images. It provides a command-line interface (CLI) for creating, running, and managing containers.
The podman machine function is used to create and manage a Podman virtual machine that contains a Podman process. This virtual machine can be used to isolate containers and provide a secure environment for running them.
The vulnerability arises from the gvproxy process spawned by the podman machine function. If port 7777 is open on the host's firewall, an attacker can use the gvproxy API to forward ports on the host to ports in the virtual machine, making private services on the virtual machine accessible to the network. This can lead to unauthorized access to sensitive information.
The vulnerability exposes sensitive information to unauthorized actors and allows them to access private services on the virtual machine. It can also disrupt the host's services by forwarding all ports to the virtual machine.
The vulnerability can be mitigated by updating podman to version 3.4.3 or later. This update fixes the origin validation error and ensures that the gvproxy API is not accessible on all IP addresses on the host.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containers/podman/v3.
