Podman Desktop includes a critical authentication bypass flaw that allows any installed extension to override native permission checks by calling isAccessAllowed() which always returns true. This enables a malicious extension to impersonate any user, hijack all authentication sessions, and access sensitive resources such as containers and Kubernetes configurations. The vulnerability is categorized as an improper authorization and missing authentication weakness. The impact is the complete loss of user isolation and the ability to compromise any resources the user was permitted to reach.

The flaw affects all editions of Podman Desktop released before version 1.25.1. The Linux Foundation’s Podman Desktop product is the only vendor listed. A patch that resolves the issue is available in release 1.25.1 and later.

The CVSS score of 8.8 reflects a high severity, while the EPSS score of less than 1 % indicates a low probability of exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalog. Because any extension can trigger the bypass, a local or user‑initiated attack is the most plausible path. Even though exploitation likelihood is low, the potential to compromise all authenticated sessions warrants immediate action.