Input validation error in Podman - CVE-2026-57231

Vulnerability identifier: #VU135854

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-57231

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper input validation in image config environment variable parsing when processing a malformed container image. A remote attacker can supply a specially crafted image to disclose sensitive information.

Environment variable entries containing only a key and no value, including wildcard forms such as an asterisk, may cause host environment variables from the launch session to be passed into the container.

Podman
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Micro
Containers Module
openSUSE Leap
podman-debuginfo
podman-remote
podman
podmansh
podman-remote-debuginfo
podman-docker

Install security update from vendor's website.

Podman - addressed in versions 5.8.4, 6.0.0
podman-debuginfo - update to 4.9.5-150500.3.78.1
podman-remote - update to 4.9.5-150500.3.78.1
podman - update to 4.9.5-150500.3.78.1
podmansh - update to 4.9.5-150500.3.78.1
podman-remote-debuginfo - update to 4.9.5-150500.3.78.1
podman-docker - update to 4.9.5-150500.3.78.1

• https://github.com/podman-container-tools/podman/security/advisories/GHSA-4hq8-gpf5-8p68
• https://github.com/podman-container-tools/podman/commit/6c431b73dbf8e4b20b778644d7a80caebdb75050

• Input validation error in Podman
• SUSE update for podman