CVE-2021-20199
published 2021-02-02CVE-2021-20199: Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized…
PriorityP431medium5.9CVSS 3.1
AVNACHPRNUINSUCNIHAN
EPSS
1.10%
62.1th percentile
Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libpod | < libpod 3.0.0~rc2+dfsg1-2 (bookworm) | libpod 3.0.0~rc2+dfsg1-2 (bookworm) |
| debian | rootlesskit | < libpod 3.0.0~rc2+dfsg1-2 (bookworm) | libpod 3.0.0~rc2+dfsg1-2 (bookworm) |
| github.com | containers_podman_v3 | >= 0 < 3.0.0 | 3.0.0 |
| libpod_project | libpod | >= 0 < 3.0.0~rc2+dfsg1-2 | 3.0.0~rc2+dfsg1-2 |
| libpod_project | libpod | >= 0 < 3.0.0~rc2+dfsg1-2 | 3.0.0~rc2+dfsg1-2 |
| msrc | cbl2_podman_4.1.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| podman_project | podman | — | — |
| podman_project | podman | >= 1.8.0 < 3.0.0 | 3.0.0 |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv5.9MEDIUM
vendor_debian5.9MEDIUM
vendor_msrc5.9MEDIUM
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Podman Origin Validation Error
ghsa·2021-05-18
CVE-2021-20199 [MEDIUM] CWE-200 Podman Origin Validation Error
Podman Origin Validation Error
Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman versions from 1.8.0 to 3.0.0.
OSV
Podman Origin Validation Error
osv·2021-05-18
CVE-2021-20199 [MEDIUM] Podman Origin Validation Error
Podman Origin Validation Error
Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman versions from 1.8.0 to 3.0.0.
OSV
CVE-2021-20199: Rootless containers run with Podman, receive all traffic with a source IP address of 127
osv·2021-02-02·CVSS 5.9
CVE-2021-20199 [MEDIUM] CVE-2021-20199: Rootless containers run with Podman, receive all traffic with a source IP address of 127
Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards.
Microsoft
Rootless containers run with Podman receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) con
vendor_msrc·2021-02-09·CVSS 5.9
CVE-2021-20199 [MEDIUM] CWE-346 Rootless containers run with Podman receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) con
Rootless containers run with Podman receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blo
Red Hat
podman: Remote traffic to rootless containers is seen as orginating from localhost
vendor_redhat·2021-01-01·CVSS 5.9
CVE-2021-20199 [MEDIUM] CWE-346 podman: Remote traffic to rootless containers is seen as orginating from localhost
podman: Remote traffic to rootless containers is seen as orginating from localhost
Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards.
A flaw was found in podman. Rootless containers receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts) which impact containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. The highest threat from this vulnerability is to data integrity.
Statement: This issue does not affect Podman prior to version 1.8.0. Podman shipped in
Debian
CVE-2021-20199: libpod - Rootless containers run with Podman, receive all traffic with a source IP addres...
vendor_debian·2021·CVSS 5.9
CVE-2021-20199 [MEDIUM] CVE-2021-20199: libpod - Rootless containers run with Podman, receive all traffic with a source IP addres...
Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards.
Scope: local
bookworm: resolved (fixed in 3.0.0~rc2+dfsg1-2)
bullseye: resolved (fixed in 3.0.0~rc2+dfsg1-2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=1919050https://github.com/containers/podman/issues/5138https://github.com/containers/podman/pull/9052https://github.com/rootless-containers/rootlesskit/pull/206https://bugzilla.redhat.com/show_bug.cgi?id=1919050https://github.com/containers/podman/issues/5138https://github.com/containers/podman/pull/9052https://github.com/rootless-containers/rootlesskit/pull/206
2021-02-02
Published