Skip to content
Fencer Vulns
medium 4.4

CVE-2026-79699 json

Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory

published 2026-09-15 54 d ago modified 2026-11-06 2 d ago also EUVD-2026-78824

cvss
4.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 6%
public exploits
0
none known

Summary

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

Patch / fix

  • skopeo openSUSE Tumbleweed 1.24.0-2.1
  • podman openSUSE Tumbleweed 6.1.2-1.1

opensuse advisories openSUSE-SU-2026:12478-1openSUSE-SU-2026:12068-1

  • podman Alpine 3.24 5.8.8-r0

alpine advisories ALPINE-CVE-2026-79699

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-79699 updated cvss 4.4

podman: buildah: skopeo: containers/storage: Malicious tar whiteout header allows replacement of extraction destination directory

  • Red Hat Ansible Automation Platform 2 python-podman, python3x-podman, python3.11-podman, python3.12-podman, ansible-automation-platform-24/eda-controller-rhel8, ansible-automation-platform-25/eda-controller-rhel8, +2 more Red Hat Enterprise Linux 8 podman, skopeo, buildah, podman-tests, skopeo-tests, buildah-tests, +7 more Red Hat Enterprise Linux 9 podman, skopeo, buildah, podman-tests, rhel9/podman, rhel9/skopeo, +9 more Red Hat Enterprise Linux 10 podman, skopeo, buildah Red Hat OpenShift Container Platform 4 podman, skopeo, podman-tests, skopeo-tests, podman-docker, podman-remote, +5 more Red Hat OpenShift Dev Spaces devspaces/udi-rhel9, devspaces/udi-base-rhel9, devspaces/udi-base-rhel10
    +2 more products
    Red Hat OpenShift Virtualization 4 container-native-virtualization/ocp-virt-validation-checkup-rhel9 Red Hat Quay 3 quay/quay-builder-rhel8, quay/quay-builder-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Hardened Images podman, skopeo, buildah
    not affected: inline mitigations already exist

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
52 d ago

Exploit prediction

0.17% chance of exploitation in the next 30 days, higher than 6% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Affected products

  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift Dev Spaces
  • Red Hat Red Hat OpenShift Virtualization 4
  • Red Hat Red Hat Quay 3

Classification

Weakness
  • CWE-59 Improper Link Resolution Before File Access

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.