CVE-2026-94603
published 2026-10-13CVE-2026-94603: Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the…
PriorityP260critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
EPSS
0.53%
44.7th percentile
Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-24 | eda-controller-rhel8 | — | — |
| ansible-automation-platform-25 | eda-controller-rhel8 | — | — |
| ansible-automation-platform-26 | eda-controller-rhel9 | — | — |
| ansible-automation-platform-27 | eda-controller-rhel9 | — | — |
| container-native-virtualization | ocp-virt-validation-checkup-rhel9 | — | — |
| container-tools_rhel8 | podman | — | — |
| devspaces | udi-base-rhel10 | — | — |
| devspaces | udi-base-rhel9 | — | — |
| devspaces | udi-rhel9 | — | — |
| github.com | containers_podman | >= 4.4.0 < 5.8.8 | 5.8.8 |
| go.podman.io | podman_v6 | >= 6.0.0 < 6.1.3 | 6.1.3 |
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| podman-container-tools | podman | — | — |
| podman-container-tools | podman | — | — |
| podman_project | podman | — | — |
| quay | quay-builder-rhel8 | — | — |
| quay | quay-builder-rhel9 | — | — |
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
vendor_redhat8.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
podman: podman: The `podman run` command can be instructed to disable almost all sandboxing - including user-requested sandboxing - by image annotation
vendor_redhat·2026-09-29·CVSS 8.6
CVE-2026-94603 [HIGH] CWE-15 podman: podman: The `podman run` command can be instructed to disable almost all sandboxing - including user-requested sandboxing - by image annotation
podman: podman: The `podman run` command can be instructed to disable almost all sandboxing - including user-requested sandboxing - by image annotation
A flaw was found in Podman. When a container image with checkpoint annotations is executed using the podman run command, Podman treats the image as a restored checkpoint and ignores user-specified sandboxing options, such as dropped privileges. An attacker can exploit this issue by enticing a user to run a specially crafted image, leading to a container sandbox bypass and potential execution with elevated system privileges.
Statement: This vulnerability is rated as having an Important severity impact for Red Hat environments because running a malicious image can completely circumvent expected confinement boundaries and grant unexpected pr
GHSA
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
ghsa·2026-10-15
CVE-2026-94603 [CRITICAL] CWE-693 Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
### Impact
Podman v4.4.0 added a feature where container checkpoints (from the `podman container checkpoint` command) could be distributed via OCI registry, and pulled from that registry and run via the `podman run` command. This allowed easy transfer of checkpoints between systems. However, checkpoints allow complete control of how the container is created - including full control of the container sandbox. When `podman run` detects a checkpoint, it will silently ignore all user input regarding how the container should be created - for example, `podman run --cap-drop=ALL` on an image that is determined to be a checkpoint will ignore `--cap-drop=all` and use the set of capabilities speci
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-94603 podman: podman: The `podman run` command can be instructed to disable almost all sandboxing - including user-requested sandboxing - by image annotation [fedora-all]
bugzilla·2026-09-29
CVE-2026-94603 [HIGH] CVE-2026-94603 podman: podman: The `podman run` command can be instructed to disable almost all sandboxing - including user-requested sandboxing - by image annotation [fedora-all]
CVE-2026-94603 podman: podman: The `podman run` command can be instructed to disable almost all sandboxing - including user-requested sandboxing - by image annotation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Podman v4.4.0 added a feature where container checkpoints (from the podman container checkpoint command) could be distributed via OCI registry, and pulled from that registry and run via the podman run command. This allowed easy transfer of checkpoints between systems. However, checkpoints allow complete control of how the container is created - including full control of the container sandbox
Bugzilla
CVE-2026-94603 podman: podman: The `podman run` command can be instructed to disable almost all sandboxing - including user-requested sandboxing - by image annotation
bugzilla·2026-09-28
CVE-2026-94603 [HIGH] CVE-2026-94603 podman: podman: The `podman run` command can be instructed to disable almost all sandboxing - including user-requested sandboxing - by image annotation
CVE-2026-94603 podman: podman: The `podman run` command can be instructed to disable almost all sandboxing - including user-requested sandboxing - by image annotation
Podman v4.4.0 added a feature where container checkpoints (from the podman container checkpoint command) could be distributed via OCI registry, and pulled from that registry and run via the podman run command. This allowed easy transfer of checkpoints between systems. However, checkpoints allow complete control of how the container is created - including full control of the container sandbox. When podman run detects a checkpoint, it will silently ignore all user input regarding how the container should be created - for example, podman run --cap-drop=ALL on an image that is determined to be a checkpoint will ignore --cap-drop
https://github.com/podman-container-tools/podman/commit/24706290d5c974f078d8ca284026802515f28e92https://github.com/podman-container-tools/podman/commit/3721ff82ffb44a4ceeaecc5abd3808e924a6b669https://github.com/podman-container-tools/podman/commit/450c64426dbcff1097d3c7911d791101e3d16f4chttps://github.com/podman-container-tools/podman/commit/7728ba0a90094408ad9078e36c3622a651d49616https://github.com/podman-container-tools/podman/commit/c74b1d37b3fb834b0de43e176565d9d8c254b627https://github.com/podman-container-tools/podman/commit/ea9243e04d1db3886dc3a51ee3300ffb547cfc02https://github.com/podman-container-tools/podman/releases/tag/v5.8.8https://github.com/podman-container-tools/podman/releases/tag/v6.1.3https://github.com/podman-container-tools/podman/security/advisories/GHSA-2cvf-wqm6-wr9g
2026-10-13
Published