CVE-2022-27649: Podman's default inheritable capabilities for linux container not empty
Summary
CVE-2022-27649: Podman's default inheritable capabilities for linux container not empty. Affects github.com/containers/podman/v4 versions < 4.0.3. Fixed in 4.0.3. How to fix ↓
Also tracked for
- github.com/containers/podman · Go
- libpod · Debian:11
The same CVE-2022-27649 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Podman is a container engine developed in Go that provides a command-line interface for managing containers and container images. It allows users to create, run, and manage containers in a secure and isolated environment. Podman is widely used in the containerization ecosystem and is known for its compatibility with the Docker API. However, a vulnerability has been discovered in Podman's default inheritable capabilities for Linux containers.
Vulnerability Detail
The vulnerability in Podman allows containers to be created with non-empty inheritable Linux process capabilities. This results in an atypical Linux environment where programs with inheritable file capabilities can elevate those capabilities to the permitted set during execve(2). While this bug does not affect the container security sandbox, as the inheritable set never contains more capabilities than the container's bounding set, it still poses a security risk. An attacker with access to a container could potentially exploit this vulnerability to gain elevated privileges and perform unauthorized actions.
How To Fix
Latest published version: v4.9.5 as of 22 Oct 2026
go get github.com/containers/podman/v4@v4.9.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.0.3
This is the first release that contains the fix.
go get github.com/containers/podman/v4@v4.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update Podman to the latest version as soon as possible.
Conclusion
In conclusion, the vulnerability in Podman's default inheritable capabilities for Linux containers poses a security risk by allowing privilege escalation. Users are advised to update their Podman installation to version 4.0.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/containers/podman/v4 →
FAQ
Podman is a container engine developed in Go that provides a command-line interface for managing containers and container images. It is known for its compatibility with the Docker API.
This vulnerability allows containers to be created with non-empty inheritable Linux process capabilities, potentially enabling privilege escalation for programs with inheritable file capabilities.
To fix this vulnerability, update your Podman installation to version 4.0.3 or later.
There is no known workaround for this vulnerability. It is recommended to update Podman to the latest version.
For more information about this vulnerability, you can refer to the official advisory from the GitHub Advisory Database.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containers/podman/v4.
