CVE-2025-6032Podman: podman missing tls verification

Description

A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.

Timeline

Scores

EPSS (exploitation in 30 days)

0.52% · top 56% of all CVEs (14 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.3.

Affected products

• podman

  • affected 4.8.0 – < 5.5.2

• Red Hat · Red Hat Enterprise Linux 10

  • unaffected 6:5.4.0-12.el10_0 – < *

• Red Hat · Red Hat Enterprise Linux 8

  • unaffected 8100020250625105344.afee755d – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 5:5.4.0-12.el9_6 – < *

• Red Hat · Red Hat Enterprise Linux 9.4 Extended Update Support

  • unaffected 4:4.9.4-18.el9_4.2 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.16

  • unaffected 4:4.9.4-14.rhaos4.16.el8 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.16

  • unaffected 416.94.202507222002-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.17

  • unaffected 5:5.2.2-8.rhaos4.17.el8 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.17

  • unaffected 417.94.202507132309-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.18

  • unaffected 418.94.202507221927-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.18

  • unaffected 5:5.2.2-9.rhaos4.18.el9 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.19

  • unaffected 4.19.9.6.202507152218-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.19

  • unaffected 5:5.4.0-6.rhaos4.19.el9 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.20

  • unaffected 4.20.9.6.202509251656-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4

  All versions: affected

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Gogithub.com/containers/podman/v4GHSA-65gg-3w2w-hr4h (opens in a new tab)
• Gogithub.com/containers/podman/v5GHSA-65gg-3w2w-hr4h (opens in a new tab)

What to do

Workaround: Download the VM image manually with another tool that verifies the TLS certificate and then pass the local image as a file path to podman, for example: # podman machine init --image <local-image-path>

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2025-19013 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-65gg-3w2w-hr4h (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-6032](https://cveledger.app/badge/CVE-2025-6032.svg)](https://cveledger.app/cve/CVE-2025-6032)

Record last updated 12 Oct 2026, 19:53 UTC.