Vulnerability · Published Oct 13, 2026 · Assigned by GitHub_M
CVE-2026-94603Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
Critical 10.0
In plain English
A critical-severity security flaw in podman from podman-container-tools. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | podman | 7:5.8.2-10.el10_2.alma.1 | ALSA-2026:88202 |
| AlmaLinux:10 | podman-docker | 7:5.8.2-10.el10_2.alma.1 | ALSA-2026:88202 |
| AlmaLinux:10 | podman-remote | 7:5.8.2-10.el10_2.alma.1 | ALSA-2026:88202 |
| AlmaLinux:10 | podman-tests | 7:5.8.2-10.el10_2.alma.1 | ALSA-2026:88202 |
| Alpine:v3.24 | podman | 5.8.8-r0 | ALPINE-CVE-2026-94603 |
| Debian:13 | podman | no fix listed | DEBIAN-CVE-2026-94603 |
| Debian:14 | podman | 5.8.6+ds1-3 | DEBIAN-CVE-2026-94603 |
| Go | github.com/containers/podman | no fix listed | GO-2026-6770 |
| Go | github.com/containers/podman/v2 | no fix listed | GO-2026-6770 |
| Go | github.com/containers/podman/v3 | no fix listed | GO-2026-6770 |
| Go | github.com/containers/podman/v4 | 5.8.8 | GHSA-2cvf-wqm6-wr9g |
| Go | github.com/containers/podman/v4 | no fix listed | GO-2026-6770 |
| Go | github.com/containers/podman/v5 | 5.8.8 | GO-2026-6770 |
| Go | github.com/containers/podman/v5 | 5.8.8 | GHSA-2cvf-wqm6-wr9g |
| Go | go.podman.io/podman/v6 | 6.1.3 | GHSA-2cvf-wqm6-wr9g |
| Go | go.podman.io/podman/v6 | 6.1.3 | GO-2026-6770 |
| Ubuntu:26.04:LTS | podman | no fix listed | UBUNTU-CVE-2026-94603 |
| Ubuntu:26.10 | podman | no fix listed | UBUNTU-CVE-2026-94603 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| podman-container-tools | podman | >= 4.4.0, < 5.8.8>= 6.0.0, < 6.1.3 |
Weakness: CWE-693 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/podman-container-tools/podman/security/advisories/GHSA-2cvf-wqm6-wr9g x_refsource_CONFIRM
- https://github.com/podman-container-tools/podman/commit/24706290d5c974f078d8ca284026802515f28e92 x_refsource_MISC
- https://github.com/podman-container-tools/podman/commit/3721ff82ffb44a4ceeaecc5abd3808e924a6b669 x_refsource_MISC
- https://github.com/podman-container-tools/podman/commit/450c64426dbcff1097d3c7911d791101e3d16f4c x_refsource_MISC
- https://github.com/podman-container-tools/podman/commit/7728ba0a90094408ad9078e36c3622a651d49616 x_refsource_MISC
- https://github.com/podman-container-tools/podman/commit/c74b1d37b3fb834b0de43e176565d9d8c254b627 x_refsource_MISC
- https://github.com/podman-container-tools/podman/commit/ea9243e04d1db3886dc3a51ee3300ffb547cfc02 x_refsource_MISC
- https://github.com/podman-container-tools/podman/releases/tag/v5.8.8 x_refsource_MISC
- https://github.com/podman-container-tools/podman/releases/tag/v6.1.3 x_refsource_MISC