CVE-2018-10856

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-07-03 · updated 2026-06-17
Weakness: CWE-250

Description

It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This results in unnecessary privileges being granted to the container.

Affected products

Libpod Project Libpod: before 0.6.1 — fixed in 0.6.1

How to fix

Upgrade to a fixed version: Libpod Project Libpod 0.6.1. Check the vendor advisory for mitigations.

References

https://access.redhat.com/errata/RHSA-2018:2037
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10856
https://github.com/projectatomic/libpod/commit/bae80a0b663925ec751ad2784ca32989403cdc24
https://access.redhat.com/errata/RHSA-2018:2037
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10856
https://github.com/projectatomic/libpod/commit/bae80a0b663925ec751ad2784ca32989403cdc24

Get alerted when CVE-2018-10856 or the next vulnerability affects your stack