Critical Security Update for Podman: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:70201: Important: podman security update. Affects podman versions < 7:5.8.2-9.el10_2.alma.1. Fixed in 7:5.8.2-9.el10_2.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Podman is a powerful tool designed for managing pods, container images, and containers, integral to the libpod library and widely used in Kubernetes environments. It allows users to create, run, and manage containers without requiring a daemon, providing a lightweight alternative to Docker. However, recent vulnerabilities have been identified that could compromise the security and stability of applications using Podman.
Vulnerability Detail
The vulnerabilities in Podman stem from various issues within its dependencies, including improper certificate validation, Denial of Service (DoS) vulnerabilities, and potential Cross-Site Scripting (XSS) attacks. These vulnerabilities can lead to severe consequences, such as unauthorized access, service interruptions, and data breaches. Notable vulnerabilities include CVE-2026-33810, which allows certificate validation bypass, and CVE-2026-56853, which exposes unencrypted HTTP/2 connections to DoS attacks.
How To Fix
Minimum fixed version
7:5.8.2-9.el10_2.alma.1
This is the first release that contains the fix.
sudo dnf update podmanTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the exposure of their Podman installations by restricting network access and avoiding untrusted sources for container images. Additionally, users should ensure that they are not using vulnerable features until the update is applied.
Conclusion
The recent vulnerabilities in Podman pose significant risks to users and their applications. It is crucial to update to the latest patched version to mitigate these risks. Users are encouraged to monitor their systems and apply necessary updates promptly to maintain security.
See every vulnerability recorded for podman →
FAQ
Podman is a container management tool that allows users to create and manage containers and pods without requiring a daemon.
The vulnerabilities include certificate validation bypass, Denial of Service attacks, and Cross-Site Scripting vulnerabilities.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application using the Vulert playground at Vulert Scanner.
As a temporary measure, limit network access and avoid using untrusted container images until you can apply the update.
For detailed information, refer to the CVE pages associated with each vulnerability listed in the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for podman.
