Medium severity · published Feb 2, 2021
CVE-2021-20199
Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts)
5.9
CVSS
1.1%
EPSS
No
On KEV
Description
Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
Podman · Podman Project
1.8.0 before 3.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-20199
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-20199
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1919050
Exploit
https://github.com/containers/podman/issues/5138
Patch
https://github.com/containers/podman/pull/9052
Patch
https://github.com/rootless-containers/rootlesskit/pull/206
More from Podman
8.8
CVE-2019-25067
A vulnerability, which was classified as critical, was found in Podman and Varlink 1.5.1
8.8
CVE-2022-1227
A privilege escalation flaw was found in Podman
7.8
CVE-2026-33414
PowerShell Command Injection in Podman HyperV Machine
7.7
CVE-2024-3056
A flaw was found in Podman
7.5
CVE-2026-57231
Podman: Malformed Image can trick podman run into leaking host environment variables into the container