CVE-2022-27649

7.5 highEPSS 1.4%

High (7.5). EPSS 1.4% chance of exploitation in the next 30 days. Fixed in github.com/containers/podman/v4 4.0.3.

A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 73% of CVEs (scores of 2026-10-31)
CWE: CWE-276
Published: 2022-04-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

fedoraproject:fedora
podman_project:podman
redhat:developer_tools
redhat:enterprise_linux
redhat:enterprise_linux_eus
redhat:enterprise_linux_for_ibm_z_systems
redhat:enterprise_linux_for_ibm_z_systems_eus
redhat:enterprise_linux_for_power_little_endian
redhat:enterprise_linux_for_power_little_endian_eus
redhat:enterprise_linux_server_aus
redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
redhat:enterprise_linux_server_tus
redhat:enterprise_linux_server_update_services_for_sap_solutions
redhat:openshift_container_platform

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-qvf8-p83w-v58j	Go	github.com/containers/podman/v4	<4.0.3	4.0.3
GO-2022-0416	Go	github.com/containers/podman	all versions	no fix published
GO-2022-0416	Go	github.com/containers/podman/v2	all versions	no fix published
GO-2022-0416	Go	github.com/containers/podman/v3	all versions	no fix published
GO-2022-0416	Go	github.com/containers/podman/v4	<4.0.3	4.0.3

References

Check your stack JSON