CVE-2025-6032
A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.
- CVSS 3.1
- 8.3
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-25)
- CWE
- CWE-295
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-65gg-3w2w-hr4h | Go | github.com/containers/podman/v4 | >=4.8.0 <=4.9.5 | no fix published |
| GHSA-65gg-3w2w-hr4h | Go | github.com/containers/podman/v5 | <5.5.2 | 5.5.2 |
| GO-2025-3777 | Go | github.com/containers/podman | all versions | no fix published |
| GO-2025-3777 | Go | github.com/containers/podman/v2 | all versions | no fix published |
| GO-2025-3777 | Go | github.com/containers/podman/v3 | all versions | no fix published |
| GO-2025-3777 | Go | github.com/containers/podman/v4 | >=4.8.0 | no fix published |
| GO-2025-3777 | Go | github.com/containers/podman/v5 | <5.5.2 | 5.5.2 |