The flaw in Podman causes data written to RUN --mount=type=bind mounts during build to persist in the host's temporary build context. As a result, any files created inside the container can appear in a directory on the host and remain accessible after the build finishes. This allows an attacker who can control the build process to leak files and potentially sensitive build artifacts, exposing confidential information.

The vulnerability affects Red Hat Enterprise Linux 8, 9, and 10 as well as Red Hat OpenShift Container Platform starting with version 4.12 through 4.18. No specific version ranges are listed; any installation of Podman on the affected platforms that includes the vulnerable code is at risk.

With a CVSS score of 7.4 and an EPSS of less than 1 %, the exploit likelihood is low in general but the impact is significant if the build environment is compromised. The attack vector is inferred to be local or via a compromised build pipeline, where the attacker supplies a Dockerfile or runs Podman with bind mounts that create or expose files. The vulnerability is not currently listed in the CISA KEV catalog, so it may not be actively exploited in the wild yet.