CVE Feed

    Dashboard / CVE / CVE-2026-94603

    CVE-2026-94603

    Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3.

    Published:Sep 29, 2026
    Last Modified:Oct 13, 2026
    EPS:Oct 13, 2026
    EPSS Score:
    CVSS Score:10

    Affected Products

    Vendor
    Podman Project
    Product
    Podman

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs
    CAPEC-107 Cross Site Tracing
    CAPEC-127 Directory Indexing
    CAPEC-13 Subverting Environment Variable Values
    CAPEC-146 XML Schema Poisoning
    CAPEC-17 Using Malicious Files
    CAPEC-176 Configuration/Environment Manipulation
    CAPEC-20 Encryption Brute Forcing
    CAPEC-203 Manipulate Registry Information
    CAPEC-22 Exploiting Trust in Client
    CAPEC-237 Escaping a Sandbox by Calling Code in Another Language
    CAPEC-270 Modification of Registry Run Keys
    CAPEC-271 Schema Poisoning
    CAPEC-36 Using Unpublished Interfaces or Functionality
    CAPEC-477 Signature Spoofing by Mixing Signed and Unsigned Content
    CAPEC-480 Escaping Virtualization
    CAPEC-51 Poison Web Service Registry
    CAPEC-57 Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
    CAPEC-579 Replace Winlogon Helper DLL
    CAPEC-59 Session Credential Falsification through Prediction
    CAPEC-65 Sniff Application Code
    CAPEC-668 Key Negotiation of Bluetooth Attack (KNOB)
    CAPEC-69 Target Programs with Elevated Privileges
    CAPEC-74 Manipulating State
    CAPEC-76 Manipulating Web Input to File System Calls
    CAPEC-77 Manipulating User-Controlled Variables
    CAPEC-87 Forceful Browsing

    Related CVEs

    CVE-2026-33414 (CVSS 4) — Podman is a tool for managing OCI containers and pods. Versions 4.8.0 through 5.8.1 contain a command injectio…
    CVE-2024-3056 (CVSS 7.7) — A flaw was found in Podman. This issue may allow an attacker to create a specially crafted container that, whe…
    CVE-2023-0778 (CVSS 6.8) — A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replac…
    CVE-2022-4122 (CVSS 5.3) — A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dock…
    CVE-2022-4123 (CVSS 3.3) — A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect abso…
    CVE-2022-2989 (CVSS 7.1) — An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive i…
    CVE-2022-2738 (CVSS 7.5) — The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included a…
    CVE-2022-2739 (CVSS 5.3) — The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included a…
    CVE-2022-27649 (CVSS 7.5) — A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vu…
    CVE-2021-4024 (CVSS 6.5) — A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine co…

    References

    https://github.com/podman-container-tools/podman/commit/24706290d5c974f078d8ca284026802515f28e92
    https://github.com/podman-container-tools/podman/commit/3721ff82ffb44a4ceeaecc5abd3808e924a6b669
    https://github.com/podman-container-tools/podman/commit/450c64426dbcff1097d3c7911d791101e3d16f4c
    https://github.com/podman-container-tools/podman/commit/7728ba0a90094408ad9078e36c3622a651d49616
    https://github.com/podman-container-tools/podman/commit/c74b1d37b3fb834b0de43e176565d9d8c254b627
    https://github.com/podman-container-tools/podman/commit/ea9243e04d1db3886dc3a51ee3300ffb547cfc02
    https://github.com/podman-container-tools/podman/releases/tag/v5.8.8
    https://github.com/podman-container-tools/podman/releases/tag/v6.1.3
    https://github.com/podman-container-tools/podman/security/advisories/GHSA-2cvf-wqm6-wr9g

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High