SB2026092965 - Improper access control in Podman

Description

This security bulletin contains information about 1 vulnerability.

1) Improper access control (CVE-ID: CVE-2026-94603)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to improper handling of checkpoint image annotations in the podman run command when processing an image containing the io.podman.annotations.checkpoint.runtime.name annotation. A remote attacker can provide a crafted image with this annotation to cause Podman to disregard user-supplied sandboxing options.

Remediation

Install update from vendor's website.

References

• https://github.com/podman-container-tools/podman/security/advisories/GHSA-2cvf-wqm6-wr9g
• https://github.com/podman-container-tools/podman/commit/fa6cef22c2baf3987b581c673bb416ef0585daf7