{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-94603", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-21T21:32:23.740Z", "datePublished": "2026-10-13T16:51:38.731Z", "dateUpdated": "2026-10-13T20:21:43.627Z"}, "containers": {"cna": {"title": "Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation", "problemTypes": [{"descriptions": [{"cweId": "CWE-693", "lang": "en", "description": "CWE-693: Protection Mechanism Failure", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/podman-container-tools/podman/security/advisories/GHSA-2cvf-wqm6-wr9g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/podman-container-tools/podman/security/advisories/GHSA-2cvf-wqm6-wr9g"}, {"name": "https://github.com/podman-container-tools/podman/commit/24706290d5c974f078d8ca284026802515f28e92", "tags": ["x_refsource_MISC"], "url": "https://github.com/podman-container-tools/podman/commit/24706290d5c974f078d8ca284026802515f28e92"}, {"name": "https://github.com/podman-container-tools/podman/commit/3721ff82ffb44a4ceeaecc5abd3808e924a6b669", "tags": ["x_refsource_MISC"], "url": "https://github.com/podman-container-tools/podman/commit/3721ff82ffb44a4ceeaecc5abd3808e924a6b669"}, {"name": "https://github.com/podman-container-tools/podman/commit/450c64426dbcff1097d3c7911d791101e3d16f4c", "tags": ["x_refsource_MISC"], "url": "https://github.com/podman-container-tools/podman/commit/450c64426dbcff1097d3c7911d791101e3d16f4c"}, {"name": "https://github.com/podman-container-tools/podman/commit/7728ba0a90094408ad9078e36c3622a651d49616", "tags": ["x_refsource_MISC"], "url": "https://github.com/podman-container-tools/podman/commit/7728ba0a90094408ad9078e36c3622a651d49616"}, {"name": "https://github.com/podman-container-tools/podman/commit/c74b1d37b3fb834b0de43e176565d9d8c254b627", "tags": ["x_refsource_MISC"], "url": "https://github.com/podman-container-tools/podman/commit/c74b1d37b3fb834b0de43e176565d9d8c254b627"}, {"name": "https://github.com/podman-container-tools/podman/commit/ea9243e04d1db3886dc3a51ee3300ffb547cfc02", "tags": ["x_refsource_MISC"], "url": "https://github.com/podman-container-tools/podman/commit/ea9243e04d1db3886dc3a51ee3300ffb547cfc02"}, {"name": "https://github.com/podman-container-tools/podman/releases/tag/v5.8.8", "tags": ["x_refsource_MISC"], "url": "https://github.com/podman-container-tools/podman/releases/tag/v5.8.8"}, {"name": "https://github.com/podman-container-tools/podman/releases/tag/v6.1.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/podman-container-tools/podman/releases/tag/v6.1.3"}], "affected": [{"vendor": "podman-container-tools", "product": "podman", "versions": [{"version": ">= 4.4.0, < 5.8.8", "status": "affected"}, {"version": ">= 6.0.0, < 6.1.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-13T16:51:38.731Z"}, "descriptions": [{"lang": "en", "value": "Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3."}], "source": {"advisory": "GHSA-2cvf-wqm6-wr9g", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-13T20:19:31.021516Z", "id": "CVE-2026-94603", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-13T20:21:43.627Z"}}]}}

{}

{"affected": [{"affectedData": [{"product": "podman", "vendor": "podman-container-tools", "versions": [{"status": "affected", "version": ">= 4.4.0, < 5.8.8"}, {"status": "affected", "version": ">= 6.0.0, < 6.1.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3."}], "id": "CVE-2026-94603", "lastModified": "2026-10-13T21:19:58.477", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-94603", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-13T20:19:31.021516Z", "version": "2.0.3"}}]}, "published": "2026-10-13T17:17:49.123", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/podman-container-tools/podman/commit/24706290d5c974f078d8ca284026802515f28e92"}, {"source": "security-advisories@github.com", "url": "https://github.com/podman-container-tools/podman/commit/3721ff82ffb44a4ceeaecc5abd3808e924a6b669"}, {"source": "security-advisories@github.com", "url": "https://github.com/podman-container-tools/podman/commit/450c64426dbcff1097d3c7911d791101e3d16f4c"}, {"source": "security-advisories@github.com", "url": "https://github.com/podman-container-tools/podman/commit/7728ba0a90094408ad9078e36c3622a651d49616"}, {"source": "security-advisories@github.com", "url": "https://github.com/podman-container-tools/podman/commit/c74b1d37b3fb834b0de43e176565d9d8c254b627"}, {"source": "security-advisories@github.com", "url": "https://github.com/podman-container-tools/podman/commit/ea9243e04d1db3886dc3a51ee3300ffb547cfc02"}, {"source": "security-advisories@github.com", "url": "https://github.com/podman-container-tools/podman/releases/tag/v5.8.8"}, {"source": "security-advisories@github.com", "url": "https://github.com/podman-container-tools/podman/releases/tag/v6.1.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/podman-container-tools/podman/security/advisories/GHSA-2cvf-wqm6-wr9g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-693"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "podman: podman: The `podman run` command can be instructed to disable almost all sandboxing - including user-requested sandboxing - by image annotation", "id": "2542566", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542566"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.6", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-15", "details": ["A flaw was found in Podman. When a container image with checkpoint annotations is executed using the podman run command, Podman treats the image as a restored checkpoint and ignores user-specified sandboxing options, such as dropped privileges. An attacker can exploit this issue by enticing a user to run a specially crafted image, leading to a container sandbox bypass and potential execution with elevated system privileges."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-94603", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-24/eda-controller-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-25/eda-controller-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-26/eda-controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-27/eda-controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "podman", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "container-tools:rhel8/podman", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "podman", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "podman", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "podman", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/udi-base-rhel10", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/udi-base-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/udi-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:container_native_virtualization:4", "fix_state": "Affected", "package_name": "container-native-virtualization/ocp-virt-validation-checkup-rhel9", "product_name": "Red Hat OpenShift Virtualization 4"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Affected", "package_name": "quay/quay-builder-rhel8", "product_name": "Red Hat Quay 3"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Affected", "package_name": "quay/quay-builder-rhel9", "product_name": "Red Hat Quay 3"}], "public_date": "2026-09-29T15:47:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-94603\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-94603"], "statement": "This vulnerability is rated as having an Important severity impact for Red Hat environments because running a malicious image can completely circumvent expected confinement boundaries and grant unexpected privileges to a container, compromising host integrity. Under default configurations, container execution relies on enforced sandboxing limits and security flags supplied by the operator. However, if an image embeds specific checkpoint metadata, the runtime automatically prioritizes the checkpoint configuration over explicit command-line restrictions, silently omitting requested security controls. Exploitation requires an operator or automated workflow to launch an untrusted image; environments that execute only vetted container workloads from trusted registries remain at reduced operational risk.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "podman", "vendor": "podman_project"}], "created": "2026-09-30T08:30:08.152036+00:00", "updated": "2026-10-13T21:00:17.517106+00:00", "vendors": ["podman_project", "podman_project$PRODUCT$podman"]}