The flaw permits an attacker to make podman overwrite a host file when the kube play command processes a Kubernetes YAML that mounts a Secret or ConfigMap volume containing a symbolic link to a host file path. The attacker can choose which file is overwritten but does not control the contents written into that file.

Red Hat Enterprise Linux 8, 9, and 10 are affected, as are Red Hat OpenShift Container Platform versions 4.12 through 4.20, OpenShift Dev Spaces 3.24, and related enterprise services. Any environment running podman versions released between v4.0.0 and v5.6.1, with the fix applied in v5.6.1 or later, is vulnerable.

The CVSS score is 8.1 and the EPSS score is below 1%, indicating a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack requires that an attacker be able to run podman kube play against an untrusted Kubernetes YAML file; this may be confined to a local user or a container‑privileged context. Proper validation of input files reduces the attack surface.