CVE-2025-6032: Podman Improper Certificate Validation Leading to Potential Man In The Middle Attack
Summary
CVE-2025-6032: Podman Improper Certificate Validation; machine missing TLS verification. Affects github.com/containers/podman/v4 versions >= 4.8.0, <= 4.9.5. No fix is published. How to fix ↓
Also tracked for
- github.com/containers/podman · Go
- podman · Debian:13
The same CVE-2025-6032 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Podman is an open-source container management tool that allows users to manage containers and images without requiring a daemon. It is designed to be a drop-in replacement for Docker, providing similar functionality with a focus on security and simplicity. The tool is widely used for developing, testing, and deploying applications in containerized environments. However, a recent vulnerability has been identified that affects its ability to securely download VM images from OCI registries.
Vulnerability Detail
The vulnerability stems from the podman machine init command, which fails to verify the TLS certificate when downloading VM images from an OCI registry. This oversight, introduced in version 5.0.0, exposes users to potential Man In The Middle (MITM) attacks, where an attacker could intercept and manipulate the data being transmitted. The lack of proper TLS verification can lead to unauthorized access and compromise the integrity of the downloaded images.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually download the disk image using a different tool that verifies the TLS connection. After downloading, they can initialize the Podman machine with the local image by using the following command: podman machine init --image ./somepath.
Conclusion
In summary, CVE-2025-6032 is a significant vulnerability in Podman that affects its TLS certificate validation when downloading VM images. Users are strongly advised to update to version 5.5.2 or later to mitigate the risk of potential Man In The Middle attacks. Additionally, a temporary workaround is available for those unable to update immediately.
See every vulnerability recorded for github.com/containers/podman/v4 →
FAQ
The CVSS score of this vulnerability is 8.3, indicating a high severity level.
The vulnerability affects Podman versions from 5.0.0 up to 5.5.1.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
Failing to address this vulnerability could allow attackers to intercept and manipulate VM images, leading to unauthorized access and potential data breaches.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the Gopkg.lock file.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containers/podman/v4.
