CVE-2025-6032

Podman: podman missing tls verification

HIGH

8.3

CVSS Score

Published: June 24, 2025 at 01:50 PM UTC

Updated: October 12, 2026 at 08:17 PM UTC

2 products affected across 2 vendorsOpenShift Container PlatformPodman

Using Red Hat Enterprise Linux 10 by Red Hat?

Get instant alerts when new vulnerabilities affect Red Hat Enterprise Linux 10 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.3

Exploit prediction

EPSS 0.5%

SSVC

No known exploit

Description

A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

OpenShift Container Platform · Red Hatcontainer

90%

All versions4

Vendor states this is fixed in 4.19.9.6.202507152218-0 (unaffected)

Vendor states this is fixed in 4.20.9.6.202509251656-0 (unaffected)

Vendor states this is fixed in 416.94.202507222002-0 (unaffected)

Vendor states this is fixed in 417.94.202507132309-0 (unaffected)

Vendor states this is fixed in 418.94.202507221927-0 (unaffected)

Vendor states this is fixed in 4:4.9.4-14.rhaos4.16.el8 (unaffected)

Vendor states this is fixed in 5:5.2.2-8.rhaos4.17.el8 (unaffected)

Vendor states this is fixed in 5:5.2.2-9.rhaos4.18.el9 (unaffected)

Vendor states this is fixed in 5:5.4.0-6.rhaos4.19.el9 (unaffected)

Podman · Containers

85%

All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references