CVE-2026-94603
CRITICAL
10,0
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: changed
Confidentiality: high
Integrity: high
Availability: high
Description
AI Translation Available
Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3.
693
Protection Mechanism Failure
DraftCommon Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism
Applicable Platforms
Technologies:
Not Technology-Specific, ICS/OT
https://github.com/podman-container-tools/podman/commit/24706290d5c974f078d8ca2…
https://github.com/podman-container-tools/podman/commit/3721ff82ffb44a4ceeaecc5…
https://github.com/podman-container-tools/podman/commit/450c64426dbcff1097d3c79…
https://github.com/podman-container-tools/podman/commit/7728ba0a90094408ad9078e…
https://github.com/podman-container-tools/podman/commit/c74b1d37b3fb834b0de43e1…
https://github.com/podman-container-tools/podman/commit/ea9243e04d1db3886dc3a51…
https://github.com/podman-container-tools/podman/releases/tag/v5.8.8
https://github.com/podman-container-tools/podman/releases/tag/v6.1.3
https://github.com/podman-container-tools/podman/security/advisories/GHSA-2cvf-…