CVE-2018-10856: Podman Elevated Container Privileges in github.com/containers/podman
Summary
CVE-2018-10856: Podman Elevated Container Privileges in github.com/containers/podman. Affects github.com/containers/podman versions < 0.6.1. Fixed in 0.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Podman is an open-source container engine that allows users to manage containers and container images. It is written in Go and provides a command-line interface for interacting with containers. The vulnerability identified as CVE-2018-10856 affects the github.com/containers/podman package. This package is widely used in the Go ecosystem and is responsible for providing container management capabilities. The vulnerability allows an attacker to gain elevated privileges within a container, potentially leading to unauthorized access or control over the host system.
Vulnerability Detail
The vulnerability arises from a flaw in the implementation of container privileges within the github.com/containers/podman package. By exploiting this flaw, an attacker can escalate their privileges within a container, granting them access to resources and capabilities that should be restricted. This can result in unauthorized access to sensitive information, unauthorized modification of containerized applications, or even control over the host system. The vulnerability has the potential to impact any application or system that relies on the affected package for container management.
How To Fix
Latest published version: v1.4.2 as of 22 Oct 2026
go get github.com/containers/podman@v1.4.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.6.1
This is the first release that contains the fix.
go get github.com/containers/podman@v0.6.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a possible workaround is to implement additional security measures within the container environment. This can include restricting container privileges, implementing access controls, and regularly monitoring container activity for any signs of unauthorized access or privilege escalation. However, it is important to note that these workarounds may not provide complete protection and updating the package to the fixed version is still the recommended solution.
Conclusion
The CVE-2018-10856 vulnerability in the github.com/containers/podman package exposes a flaw in container privilege enforcement, allowing attackers to gain elevated privileges within containers. This can lead to unauthorized access or control over the host system. It is crucial to update the package to version 0.6.1 or later to mitigate the vulnerability. Implementing additional security measures within the container environment can serve as a temporary workaround if immediate package update is not feasible.
See every vulnerability recorded for github.com/containers/podman →
FAQ
The vulnerability allows an attacker to gain elevated privileges within a container, potentially leading to unauthorized access or control over the host system.
The vulnerability affects the github.com/containers/podman package, which is widely used for container management in the Go ecosystem.
To fix this vulnerability, update the github.com/containers/podman package to version 0.6.1 or later.
If updating the package is not immediately feasible, implementing additional security measures within the container environment can serve as a temporary workaround.
To check if your application is affected by this vulnerability, you can use Vulert's playground at Vulert Scanner. It analyzes your Gopkg.lock file and alerts you in real-time for open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containers/podman.
