Read the docs
TI-2021-03497 Aliases CVE-2021-20199GHSA-grh6-q6m2-rh72

Origin validation error in podman

Priority LOW 29CWE-346Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass, Information disclosure
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-346 and CWE-200.

Summary

Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards.

Why it matters now

EPSS 0.01159 67th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial github.com/containers/podman/v3 (Go): 3.0.0Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—podmanpodman 1.8.0 onwards—No fix listedCNA
—github.com/containers/podman/v3 (Go)before 3.0.03.0.0Patch availableGHSA-grh6-q6m2-rh72
  • podman Vendor— Affected podman 1.8.0 onwards Fixed in — No fix listed CNA
  • github.com/containers/podman/v3 (Go) Vendor— Affected before 3.0.0 Fixed in 3.0.0 Patch available GHSA-grh6-q6m2-rh72

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:podman_project:podman:*:*:*:*:*:*:*:*1.8.0 to before 3.0.0VulnerablePodman Project
  • cpe:2.3:a:podman_project:podman:*:*:*:*:*:*:*:* Versions 1.8.0 to before 3.0.0 Vulnerable ·Podman Project

Remediation

  • Fix · GHSA-grh6-q6m2-rh72 github.com/containers/podman/v3 (Go) Fixed in 3.0.0 Advisory →

Red Hat 2 advisories

  • RHSA-2022:7954 Released 2022-11-15 · Red Hat rating Moderate
    podman security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) podman-2:4.2.0-3.el9, podman-docker-2:4.2.0-3.el9, podman-gvproxy-2:4.2.0-3.el9 +3
  • RHSA-2021:1796 Released 2021-05-18 · Red Hat rating Moderate
    container-tools:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) buildah-1.19.7-1.module+el8.4.0+10607+f4da7515.aarch64::container-tools:rhel8, buildah-1.19.7-1.module+el8.4.0+10607+f4da7515.ppc64le::container-tools:rhel8, buildah-1.19.7-1.module+el8.4.0+10607+f4da7515.s390x::container-tools:rhel8 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:1796
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2022:7954
Not affected: 3 products
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat OpenShift Container Platform 3.11

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-20199
  2. 2026-10-03 Alias added: GHSA-grh6-q6m2-rh72

References

Exploit 1

Patch 2

Advisory 2

Other 2

  • TI-2026-40201 Podman: WORKDIR symlink traversal vulnerability CVSS 3.1MEDIUM 5.3
  • TI-2022-01114 Improper privilege management in psgo CVSS 3.1HIGH 8.8
  • TI-2019-15207 Podman/Varlink API Privilege Escalation CVSS 3.1HIGH 8.8
  • TI-2022-10630 Incorrect default permissions in podman CVSS 3.1HIGH 7.5
  • TI-2022-02536 Use after free in podman CVSS 3.1HIGH 7.5
  • TI-2024-02862 Podman: kernel: containers in shared ipc namespace are vulnerable to denial of service attack CVSS 3.1HIGH 7.7
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences