8.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-6032

CVE-2025-6032: Podman Improper Certificate Validation; machine missing TLS verification

Impact

The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry (which it does by default since 5.0.0) allowing a possible Man In The Middle attack.

Patches

https://github.com/containers/podman/commit/726b506acc8a00d99f1a3a1357ecf619a1f798c3 Fixed in v5.5.2

Workarounds

Download the disk image manually via some other tool that verifies the TLS connection. Then pass the local image as file path (podman machine init --image ./somepath)

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-6032

CVE-2025-6032:

8.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/containers/podman/v5	go	< 5.5.2	5.5.2
github.com/containers/podman/v4	go	>= 4.8.0, <= 4.9.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from improper TLS certificate validation when Podman downloads VM images for 'podman machine init'. The root cause was identified in the way the 'types.SystemContext' was being initialized in two key functions: 'Pull' and 'getDestArtifact' within the 'pkg/machine/ocipull' package.

In both functions, a boolean field 'TLSVerify' was used to control TLS verification. The logic DockerInsecureSkipTLSVerify: types.NewOptionalBool(!options.TLSVerify) was flawed. In Go, the default value for a boolean is false. Consequently, if the TLSVerify option was not explicitly set to true by the caller, it would default to false, causing !options.TLSVerify to evaluate to true. This resulted in DockerInsecureSkipTLSVerify being set to true, effectively disabling TLS certificate validation during the image download process.

This insecure default behavior exposed users of podman machine init to Man-in-the-Middle (MITM) attacks, where an attacker could intercept the connection to the OCI registry and provide a malicious VM image.

The patch addresses this by replacing the TLSVerify boolean with a types.OptionalBool named SkipTLSVerify. This change makes the intention clearer and shifts the logic to be secure by default. The DockerInsecureSkipTLSVerify field is now set directly from options.SkipTLSVerify, which, if not provided, defaults to false, thus enabling TLS verification. Any engineer with this CVE in their environment should understand that any podman machine init command that pulls a VM image from a remote registry without explicitly enabling TLS verification is vulnerable.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.