CVE-2021-4024A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process)…
- 6.5MediumCVSS base score
- 1.1%Exploitation in 30 daysEPSS · top 33% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM.
Timeline
ID reserved
By redhat
- 27 days later
· 27 days later
Published
- 3 years later
· 3 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Medium6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L |
- EPSS (exploitation in 30 days)
- 1.1% · top 33% of all CVEs (15 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.
Affected products
podman
- affected podman 3.4.3
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Gogithub.com/containers/podman/v3GHSA-3cf2-x423-x582 (opens in a new tab)
References
References3
- https://bugzilla.redhat.com/show_bug.cgi?id=2026675%2C (opens in a new tab)x_refsource_MISCx_transferred
- https://github.com/containers/podman/releases/tag/v3.4.3 (opens in a new tab)x_refsource_MISCx_transferred
- FEDORA-2021-6bd024d2a7 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2022-0432 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-3cf2-x423-x582 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2021-4024)Record last updated .