SB20260629136 - Input validation error in Podman

Description

This security bulletin contains information about 1 vulnerability.

1) Input validation error (CVE-ID: CVE-2026-57231)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper input validation in image config environment variable parsing when processing a malformed container image. A remote attacker can supply a specially crafted image to disclose sensitive information.

Environment variable entries containing only a key and no value, including wildcard forms such as an asterisk, may cause host environment variables from the launch session to be passed into the container.

Remediation

Install update from vendor's website.

References

• https://github.com/podman-container-tools/podman/security/advisories/GHSA-4hq8-gpf5-8p68
• https://github.com/podman-container-tools/podman/commit/6c431b73dbf8e4b20b778644d7a80caebdb75050