SB2026081031 - SUSE update for podman
Published: August 10, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Link following (CVE-ID: CVE-2026-55686)
CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to modify files or directories on the host filesystem.
The vulnerability exists due to improper link resolution in WORKDIR path handling when processing a malicious container image with a symlink in the WORKDIR path. A remote attacker can run a crafted container image to modify files or directories on the host filesystem.
A race condition may also allow ownership changes on the host filesystem if an untrusted process mutates the host filesystem tree during path dereferencing.
2) Input validation error (CVE-ID: CVE-2026-57231)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper input validation in image config environment variable parsing when processing a malformed container image. A remote attacker can supply a specially crafted image to disclose sensitive information.
Environment variable entries containing only a key and no value, including wildcard forms such as an asterisk, may cause host environment variables from the launch session to be passed into the container.
Remediation
Install update from vendor's website.