Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation

Impact Podman v4.4.0 added a feature where container checkpoints from the podman container checkpoint command could be distributed via OCI registry, and pulled from that registry and run via the podman run command. This allowed easy transfer of checkpoints between systems. However, checkpoints...

GHSA-2CVF-WQM6-WR9G Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation

Impact Podman v4.4.0 added a feature where container checkpoints from the podman container checkpoint command could be distributed via OCI registry, and pulled from that registry and run via the podman run command. This allowed easy transfer of checkpoints between systems. However, checkpoints...

EUVD-2026-98929

Podman: The podman run command can be instructed to disable almost all sandboxing by image annotation...

CVE-2026-94603

Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL,...

CVE-2026-94603

The Podman container management tool is vulnerable to a sandbox bypass when using the podman run command on images containing the io.podman.annotations.checkpoint.runtime.name annotation. The software incorrectly treats these as checkpoints, silently ignoring user-supplied security restrictions s...

CVE-2026-94603

Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL,...

CVE-2026-94603

Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL,...

CVE-2026-94603

Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL,...

CVE-2026-94603 Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation

Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL,...

CVE-2026-94603: Protection Mechanism Failure

Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL,...

podman -- vulnerabilities

The Podman developers report: This release addresses CVE-2026-94603, where a "podman run" on a checkpoint image any image with the io.podman.annotations.checkpoint.runtime.name annotation could disable all sandboxing, including sandboxing specified by the user, when the container was created...

PT-2026-102916

Name of the Vulnerable Software and Affected Versions Podman versions prior to 6.1.3 Podman versions prior to 5.8.8 Description An issue exists that allows container images to disable sandboxing during the execution of the podman run command. Recommendations Upgrade to Podman version 6.1.3. Upgra...

Linux Distros Unpatched Vulnerability : CVE-2026-94603

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the...

Podman: Malformed Image can trick podman run into leaking host environment variables into the container

Summary An container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk will cause podman to pass all host variables into the container. So...

SUSE SLES15 Security Update : runc (SUSE-SU-2020:0944-1)

This update for runc fixes the following issues : runc was updated to v1.0.0rc10 CVE-2019-19921: Fixed a mount race condition with shared mounts bsc1160452. Fixed an issue where podman run hangs when spawned by salt-minion process bsc1149954. Note that Tenable Network Security has extracted the...