CVE-2025-6032
A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.3
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
- EPSS probability
- 0.48%
- CWE
- CWE-295
- Published
- 2025-06-24
- Last modified
- 2026-08-31
Affected products
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
- Red Hat Red Hat OpenShift Container Platform 4.16
- Red Hat Red Hat OpenShift Container Platform 4.16
- Red Hat Red Hat OpenShift Container Platform 4.17
- Red Hat Red Hat OpenShift Container Platform 4.17
Weakness type
Related vulnerabilities
- CVE-2026-87608 — Improper certificate validation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging so
- CVE-2026-66795 — Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin)
- CVE-2026-78234 — Hawtio-operator: hawtio-operator: service-ca signing oracle allows arbitrary-cn certificate issuance to namespace edit users
- CVE-2026-85102 — Improper Certificate Validation in Quantum Security Gateway
- CVE-2026-32253 — Sunshine: Authentication bypass via improper client certificate validation
- CVE-2026-16835 — Power System Improper Certificate Validation
- CVE-2026-82180 — In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication polic
- CVE-2026-22093 — Adversary-in-the-Middle (AitM) attack vulnerability in EVbee Service app