Description (CNA)
Podman Desktop is a graphical tool for developing on containers and Kubernetes. A critical authentication bypass vulnerability in Podman Desktop prior to version 1.25.1 allows any extension to completely circumvent permission checks and gain unauthorized access to all authentication sessions. The `isAccessAllowed()` function unconditionally returns `true`, enabling malicious extensions to impersonate any user, hijack authentication sessions, and access sensitive resources without authorization. This vulnerability affects all versions of Podman Desktop. Version 1.25.1 contains a patch for the issue.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| podman-desktop / podman-desktop | affected < 1.25.1 |
CWE
CWE-285
References
- https://github.com/podman-desktop/podman-desktop/security/advisories/GHSA-v3fx-qg34-6g9m
- https://drive.google.com/file/d/1ib4RG34mGHDlXeyib8L2j9L5rEDxuDM5/view?usp=sharing
ADP enrichment
No English description supplied.
No references supplied.