Skip to content
Fencer Vulns
high 7.5

CVE-2026-57231 json

Podman: Malformed Image can trick podman run into leaking host environment variables into the container

published 2026-06-26 4 mo ago modified 2026-10-25 14 d ago also EUVD-2026-39807 , GHSA-4hq8-gpf5-8p68 , GO-2026-6594

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 38%
public exploits
0
none known

Summary

Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk (*) will cause podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all podman environment variables that are set in the session from where the container is launched. This vulnerability is fixed in 5.8.4 and 6.0.0.

Patch / fix

  • go github.com/containers/podman/v5 5.8.4
  • go go.podman.io/podman/v6 6.0.0
  • podman_project podman 5.8.4
  • podman Debian 14 5.8.4+ds1-1

debian advisories DEBIAN-CVE-2026-57231

  • crit RHEL 8 3.18-5.module+el8.10.0+24510+6ea3880e
  • criu RHEL 8 3.18-5.module+el8.10.0+24510+6ea3880e
  • crun RHEL 8 1.14.3-2.module+el8.10.0+24510+6ea3880e
  • runc RHEL 8 4:1.2.9-4.module+el8.10.0+24510+6ea3880e
  • udica RHEL 8 0.2.6-21.module+el8.10.0+24510+6ea3880e
  • conmon RHEL 8 3:2.1.10-1.module+el8.10.0+24510+6ea3880e
  • podman RHEL 8 4:4.9.4-34.module+el8.10.0+24510+6ea3880e
  • skopeo RHEL 8 2:1.14.6-2.module+el8.10.0+24510+6ea3880e

red hat advisories RHSA-2026:38504RHSA-2026:37123RHSA-2026:37072RHSA-2026:29954

  • podman Linux Micro 6.1 5.4.2-slfo.1.1_6.1
  • podman SLES for SAP applications 16.0, SLES 16.0 5.4.2-160000.6.1
  • podman Enterprise Storage 7.1 4.9.5-150300.9.83.1
  • podman SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +3 more 4.9.5-150400.4.79.1
  • podman Linux Micro 6.0 4.9.5-13.1
  • podman SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES 15 SP6-LTSS +5 more 4.9.5-150500.3.78.1

suse advisories SUSE-SU-2026:24378-1SUSE-SU-2026:24233-1SUSE-SU-2026:3662-1SUSE-SU-2026:3652-1SUSE-SU-2026:23205-1SUSE-SU-2026:3536-1

  • podman openSUSE Leap 16.0 5.4.2-160000.6.1
  • podman openSUSE Tumbleweed 6.0.2-1.1

opensuse advisories openSUSE-SU-2026:22089-1openSUSE-SU-2026:11437-1

  • crit AlmaLinux 8 3.18-5.module_el8.10.0+4047+545787c4
  • crit AlmaLinux 8 3.18-5.module_el8.10.0+3901+4b80ecd7
  • crit AlmaLinux 8 3.18-5.module_el8.10.0+4120+03ad4b47
  • crit AlmaLinux 8 3.18-5.module_el8.10.0+3845+87b84552
  • criu AlmaLinux 8 3.18-5.module_el8.10.0+4089+ce72bbbe
  • criu AlmaLinux 8 3.18-5.module_el8.10.0+4120+03ad4b47
  • criu AlmaLinux 8 3.18-5.module_el8.10.0+3876+e55593a8
  • criu AlmaLinux 8 3.18-5.module_el8.10.0+3909+6e1c1eb7

almalinux advisories ALSA-2026:38504ALSA-2026:37123

  • criu Rocky Linux 8 3.18-5.module+el8.10.0+1880+8e896d1b
  • criu Rocky Linux 8 3.18-5.module+el8.10.0+1874+ce489889
  • criu Rocky Linux 8 3.18-5.module+el8.10.0+1948+4b5cd4a9
  • criu Rocky Linux 8 3.18-5.module+el8.10.0+40047+0c0a73f4
  • criu Rocky Linux 8 3.18-5.module+el8.10.0+1843+6892ab28
  • criu Rocky Linux 8 3.18-5.module+el8.10.0+1872+2e18eb19
  • criu Rocky Linux 8 3.18-5.module+el8.10.0+2001+6a33db9f
  • criu Rocky Linux 8 3.18-5.module+el8.10.0+40133+32c21f88

rocky linux advisories RLSA-2026:38504RLSA-2026:37072RLSA-2026:37123

  • podman Alpine 3.24 5.8.6-r0

alpine advisories ALPINE-CVE-2026-57231

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-57231 updated cvss 7.5

podman: Podman: Information disclosure via malicious container image environment variables

  • Red Hat Enterprise Linux 8 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +2 more Red Hat OpenShift Container Platform 4 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +3 more Red Hat OpenShift Container Platform 5 podman, openshift/ose-rhel-coreos-9 Red Hat OpenStack Platform 18.0 rhoso-operators/prometheus-podman-exporter-rhel9 Red Hat Quay 3 quay/quay-builder-rhel9
    affected: workaround, no fix available
  • Red Hat Enterprise Linux AppStream (v. 8) crit 3.18-5.module+el8.10.0+24510+6ea3880e, criu 3.18-5.module+el8.10.0+24510+6ea3880e, runc 1.2.9-4.module+el8.10.0+24510+6ea3880e, crun 1.14.3-2.module+el8.10.0+24510+6ea3880e, udica 0.2.6-21.module+el8.10.0+24510+6ea3880e, conmon 2.1.10-1.module+el8.10.0+24510+6ea3880e, +27 more
    fixed: vendor fix RHSA-2026:38504
  • Red Hat Enterprise Linux AppStream (v. 9) podman 5.8.2-4.el9_8, podman-tests 5.8.2-4.el9_8, podman-docker 5.8.2-4.el9_8, podman-remote 5.8.2-4.el9_8, podman-plugins 5.8.2-4.el9_8
    fixed: vendor fix RHSA-2026:37123
  • Red Hat Enterprise Linux AppStream (v. 10) podman 5.8.2-4.el10_2, podman-docker 5.8.2-4.el10_2, podman-remote 5.8.2-4.el10_2 Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) podman-tests 5.8.2-4.el10_2
    fixed: vendor fix RHSA-2026:37072
  • Red Hat Hardened Images podman 6.0.0-1.hum1, podmansh 6.0.0-1.hum1, podman-tests 6.0.0-1.hum1, podman-docker 6.0.0-1.hum1, podman-remote 6.0.0-1.hum1, podman-machine 6.0.0-1.hum1
    fixed: vendor fix RHSA-2026:29954
  • Red Hat OpenShift Container Platform 4.22 rhcos 4.22.9.8.202607220526
    fixed: vendor fix RHSA-2026:44232
  • Red Hat Quay 3.9 quay/quay-rhel8 1785950004
    fixed: vendor fix RHSA-2026:50931
  • Red Hat Quay 3.10 quay/quay-rhel8 1786395065
    fixed: vendor fix RHSA-2026:53520
show 7 more
  • Red Hat Quay 3.12 quay/quay-rhel8 1786170635
    fixed: vendor fix RHSA-2026:52968
  • Red Hat Quay 3.14 quay/quay-rhel8 1788593843
    fixed: vendor fix RHSA-2026:70267
  • Red Hat Quay 3.15 quay/quay-builder-rhel8 1787824210
    fixed: vendor fix RHSA-2026:63307
  • Red Hat Quay 3.16 quay/quay-rhel9 1789563753
    fixed: vendor fix RHSA-2026:69255
  • Red Hat Quay 3.17 quay/quay-rhel9 1786181981
    fixed: vendor fix RHSA-2026:54395
  • Red Hat Ansible Automation Platform 2 ansible-automation-platform-26/eda-controller-rhel9, ansible-automation-platform-27/eda-controller-rhel9
    not affected: component not present
  • Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9 Red Hat Enterprise Linux 8 conmon Red Hat Enterprise Linux 9 conmon Red Hat Enterprise Linux 10 conmon Red Hat OpenShift Container Platform 4 cri-o, conmon, kata-containers Red Hat OpenShift Container Platform 5 conmon
    +10 more products
    Red Hat OpenShift Dev Spaces devspaces/udi-rhel9, devspaces/udi-base-rhel9, devspaces/udi-base-rhel10 Red Hat OpenShift Virtualization 4 container-native-virtualization/ocp-virt-validation-checkup-rhel9 Red Hat Quay 3.9 quay/clair-rhel8 1785563558, quay/quay-builder-rhel8 1785563573, quay/quay-operator-rhel8 1785563557, quay/quay-operator-bundle 1785954125, quay/quay-bridge-operator-rhel8 1785563571, quay/quay-bridge-operator-bundle 1785564443, +3 more Red Hat Quay 3.10 quay/clair-rhel8 1786394800, quay/quay-builder-rhel8 1786394811, quay/quay-operator-rhel8 1786394797, quay/quay-operator-bundle 1786398374, quay/quay-bridge-operator-rhel8 1786394781, quay/quay-bridge-operator-bundle 1786395288, +3 more Red Hat Quay 3.12 quay/clair-rhel8 1786170209, quay/quay-builder-rhel8 1786170241, quay/quay-operator-rhel8 1786170245, quay/quay-operator-bundle 1786174731, quay/quay-bridge-operator-rhel8 1786170019, quay/quay-bridge-operator-bundle 1786171106, +3 more Red Hat Quay 3.14 quay/clair-rhel8 1788593782, quay/quay-builder-rhel8 1788593707, quay/quay-operator-rhel8 1788593658, quay/quay-operator-bundle 1788598271, quay/quay-bridge-operator-rhel8 1788594258, quay/quay-bridge-operator-bundle 1788595604, +3 more Red Hat Quay 3.15 quay/quay-rhel8 1788191755, quay/clair-rhel8 1787986213, quay/quay-operator-rhel8 1787987657, quay/quay-operator-bundle 1788196149, quay/quay-bridge-operator-rhel8 1787986808, quay/quay-bridge-operator-bundle 1787987365, +3 more Red Hat Quay 3.16 quay/clair-rhel9 1789191202, quay/quay-builder-rhel9 1789492236, quay/quay-operator-rhel9 1789190909, quay/quay-operator-bundle 1789627085, quay/quay-bridge-operator-rhel9 1789191073, quay/quay-bridge-operator-bundle 1789191920, +3 more Red Hat Quay 3.17 quay/clair-rhel9 1786181669, quay/quay-builder-rhel9 1786181688, quay/quay-operator-rhel9 1786181701, quay/quay-operator-bundle 1786429805, quay/quay-bridge-operator-rhel9 1786181654, quay/quay-bridge-operator-bundle 1786182526, +3 more Red Hat Trusted Profile Analyzer rhtpa/rhtpa-trustification-service-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
go github.com/containers/podman/v5
<5.8.4
5.8.4
go go.podman.io/podman/v6
<6.0.0
6.0.0
go github.com/containers/podman/v4
<=4.9.5
all versions
 no fix listed
go github.com/containers/podman/v3
<=3.4.7
all versions
 no fix listed
go github.com/containers/podman/v2
<=2.2.1
all versions
 no fix listed
go github.com/containers/podman
>=1.8.1
all versions
 no fix listed
go github.com/containers/libpod
>=1.8.1
 no fix listed

Affected products

  • podman-container-tools podman

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-668 Exposure of Resource to Wrong Sphere

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.