Container Management Tool Vulnerability in Podman from Container Tools
CVE-2026-94603
What is CVE-2026-94603?
Podman, a widely used tool for managing OCI containers and pods, has a significant issue in versions 4.4.0 up to 5.8.8 and 6.1.3. The vulnerability arises when executing the 'podman run' command with images that include the 'io.podman.annotations.checkpoint.runtime.name' annotation. This misconfiguration allows the tool to overlook specific user-defined container creation restrictions, such as '--cap-drop=ALL'. As a result, image-controlled checkpoint states can select less secure sandbox capabilities, potentially compromising the container's security model. It is important to note that rootless containers are unaffected by this vulnerability, as checkpoint and restore functionalities are not available under that mode. The issue has been remedied in subsequent versions 5.8.8 and 6.1.3.
Affected Version(s)
podman >= 4.4.0, < 5.8.8 < 4.4.0, 5.8.8
podman >= 6.0.0, < 6.1.3 < 6.0.0, 6.1.3