Medium severity5.9NVD Advisory· Published Feb 11, 2020· Updated Jun 17, 2026
CVE-2020-1726
CVE-2020-1726
Description
A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/containers/podmanGo | >= 1.6.0, < 2.0.6 | 2.0.6 |
github.com/containers/podman/v2Go | < 2.0.6 | 2.0.6 |
Affected products
27- ghsa-coords26 versionspkg:golang/github.com/containers/podmanpkg:golang/github.com/containers/podman/v2pkg:rpm/almalinux/critpkg:rpm/almalinux/criupkg:rpm/almalinux/python3-criupkg:rpm/almalinux/python-podman-apipkg:rpm/almalinux/slirp4netnspkg:rpm/almalinux/toolboxpkg:rpm/almalinux/udicapkg:rpm/opensuse/conmon&distro=openSUSE%20Leap%2015.1pkg:rpm/opensuse/conmon&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/fuse-overlayfs&distro=openSUSE%20Leap%2015.1pkg:rpm/opensuse/fuse-overlayfs&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/libcontainers-common&distro=openSUSE%20Leap%2015.1pkg:rpm/opensuse/libcontainers-common&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/podman&distro=openSUSE%20Leap%2015.1pkg:rpm/opensuse/podman&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/podman&distro=openSUSE%20Tumbleweedpkg:rpm/suse/conmon&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Containers%2015%20SP1pkg:rpm/suse/conmon&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Containers%2015%20SP2pkg:rpm/suse/fuse-overlayfs&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Containers%2015%20SP1pkg:rpm/suse/fuse-overlayfs&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Containers%2015%20SP2pkg:rpm/suse/libcontainers-common&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP1pkg:rpm/suse/libcontainers-common&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP2pkg:rpm/suse/podman&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Containers%2015%20SP1pkg:rpm/suse/podman&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Containers%2015%20SP2
>= 1.6.0, < 2.0.6+ 25 more
- (no CPE)range: >= 1.6.0, < 2.0.6
- (no CPE)range: < 2.0.6
- (no CPE)range: < 3.12-9.module_el8.3.0+2044+12421f43
- (no CPE)range: < 3.12-9.module_el8.4.0+2496+12421f43
- (no CPE)range: < 3.12-9.module_el8.3.0+2044+12421f43
- (no CPE)range: < 1.2.0-0.2.gitd0a45fe.module_el8.5.0+2635+e4386a39
- (no CPE)range: < 0.4.2-3.git21fdece.module_el8.5.0+2635+e4386a39
- (no CPE)range: < 0.0.7-1.module_el8.5.0+108+00865455
- (no CPE)range: < 0.2.1-2.module_el8.5.0+108+00865455
- (no CPE)range: < 2.0.20-lp151.5.1
- (no CPE)range: < 2.0.20-lp152.4.3.1
- (no CPE)range: < 1.1.2-lp151.8.1
- (no CPE)range: < 1.1.2-lp152.2.3.1
- (no CPE)range: < 20200727-lp151.2.10.1
- (no CPE)range: < 20200727-lp152.2.3.1
- (no CPE)range: < 2.0.6-lp151.3.21.1
- (no CPE)range: < 2.0.6-lp152.4.3.1
- (no CPE)range: < 3.3.1-2.1
- (no CPE)range: < 2.0.20-3.6.1
- (no CPE)range: < 2.0.20-3.6.1
- (no CPE)range: < 1.1.2-3.9.1
- (no CPE)range: < 1.1.2-3.9.1
- (no CPE)range: < 20200727-3.12.1
- (no CPE)range: < 20200727-3.12.1
- (no CPE)range: < 2.0.6-4.25.1
- (no CPE)range: < 2.0.6-4.25.1
Patches
Vulnerability mechanics
References
10- bugzilla.redhat.com/show_bug.cginvdIssue TrackingPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-vmhj-p9hw-vgrfghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-1726ghsaADVISORY
- lists.opensuse.org/opensuse-security-announce/2020-09/msg00097.htmlnvdWEB
- lists.opensuse.org/opensuse-security-announce/2020-09/msg00103.htmlnvdWEB
- access.redhat.com/errata/RHSA-2020:0680nvdWEB
- access.redhat.com/errata/RHSA-2020:1650ghsaWEB
- access.redhat.com/security/cve/CVE-2020-1726ghsaWEB
- bugzilla.redhat.com/show_bug.cgighsaWEB
- github.com/containers/podman/commit/c140ecdc9b416ab4efd4d21d14acd63b6adbdd42ghsaWEB
News mentions
0No linked articles in our index yet.