CVE-2018-10856: libpod_project libpod Execution with Unnecessary Privileges
Vulnerability summary
CVE-2018-10856 is a high (CVSS 8.8) Execution with Unnecessary Privileges vulnerability in libpod_project libpod. EPSS estimates a 0.88% chance of exploitation in the next 30 days, higher than 59.1% of scored vulnerabilities.
Not severe (CVSS 5.3, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 02-07-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This results in unnecessary privileges being granted to the container.
CVSS metrics
6 scores · 4 sources · 3 versions- CVE.orgCNA5.3MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
- OSV · Red hatEcosystem advisory · calculated5.3MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
- OSV · GoEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.88%
Chance of exploitation in the next 30 days
Percentile
59%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.88% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-250Execution with Unnecessary PrivilegesThe product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Github.com/containers/podman3 products
- v2All versions (No fix recorded)
- v3All versions (No fix recorded)
- v4All versions (No fix recorded)
Redhat2 products
- podman< 0:0.6.1-3.git3e0ff12.el7
- podman-debuginfo< 0:0.6.1-3.git3e0ff12.el7
[unknown]1 product
- podmanpodman 0.6.1
Github.com/containers1 product
- podman< 0.6.1
Libpod_project1 product
- libpod< 0.6.1
5 vendors · 8 products
References
11 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10856X Refsource CONFIRMIssue TrackingThird Party AdvisoryWEB
- github.com/projectatomic/libpod/commit/bae80a0b663925ec751ad2784ca32989403cdc24X Refsource CONFIRMPatchThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2018:2037Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB
- github.com/containers/podmanPACKAGE