{"id":"CVE-2026-121885","kind":"vulnerability","aliases":["CVE-2026-121885"],"related":[],"title":"Podman: crafted image labels let auto-update restart arbitrary services","description":"A flaw was found in Podman. An attacker can trigger a Denial of Service (DoS) by supplying a container image containing crafted metadata labels. Podman's auto-update mechanism improperly trusts these image labels to determine which system services to restart. If a user runs the malicious container and auto-update processes it, arbitrary system services are restarted with the user's privileges, potentially allowing an attacker to shut down the host system when Podman runs with administrative privileges.","summary":"Podman's auto-update reads service names from container image labels and restarts whatever units those labels name. A crafted image can make a host service restart, which can cause a denial of service and, when Podman runs with administrative privileges, can shut the host down.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["containers","linux","podman","runtime","self-hosted"],"not_affected_if":["no-auto-update","rootless-only","trusted-images-only"],"how_to_check":"- `podman --version` and compare against the fixed release, if the sources give one\n- Look for containers with auto-update enabled (`io.containers.autoupdate` label) on hosts running `podman auto-update`\n- Review which images those containers pull and whether they come from trusted registries","fix":null,"status":"open","published_at":"2026-11-10T15:17:15+00:00","first_seen_at":"2026-11-10T15:22:22+00:00","triaged_at":"2026-11-10T15:22:46+00:00","updated_at":"2026-11-10T15:22:46+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-10T15:22:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Podman: crafted image labels let auto-update restart arbitrary services","impact":"medium","summary":"Podman's auto-update reads service names from container image labels and restarts whatever units those labels name. A crafted image can make a host service restart, which can cause a denial of service and, when Podman runs with administrative privileges, can shut the host down.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["podman","containers","linux","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"A crafted image restarts host services, possibly shutting the host down","analyst_note":"Find the fixed Podman version and the auto-update advisory in the NVD entry or upstream Podman release notes; sources give no fix.","how_to_check":"- `podman --version` and compare against the fixed release, if the sources give one\n- Look for containers with auto-update enabled (`io.containers.autoupdate` label) on hosts running `podman auto-update`\n- Review which images those containers pull and whether they come from trusted registries","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-auto-update","trusted-images-only","rootless-only"],"who_is_affected":"Hosts that run Podman and use its auto-update feature on container images from sources that are not fully trusted, especially when Podman runs as root. Systems that do not use auto-update, or that only pull images they build and control, are unlikely to be exposed. The sources do not name fixed versions.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000748,"input_tokens":4576,"output_tokens":581,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121885':14A,17A '-2026':13A,16A 'administr':65B,150C 'allow':137C 'arbitrari':10A,126C 'attack':78C,139C 'auto':7A,28B,98C,122C 'auto-upd':6A,27B,97C,121C 'caus':55B 'contain':18B,34B,89C,91C,119C 'craft':2A,45B,92C 'cve':12A,15A 'denial':57B,82C 'determin':107C 'dos':85C 'flaw':72C 'found':74C 'host':24B,50B,70B,144C 'imag':3A,35B,46B,90C,104C 'improp':101C 'label':4A,36B,42B,94C,105C 'let':5A 'linux':19B 'make':48B 'malici':118C 'mechan':100C 'metadata':93C 'name':32B,43B 'podman':1A,20B,25B,62B,76C,95C,147C 'potenti':136C 'privileg':66B,135C,151C 'process':124C 'read':30B 'restart':9A,38B,52B,112C,130C 'run':63B,116C,148C 'runtim':21B 'self':23B 'self-host':22B 'servic':11A,31B,51B,59B,84C,110C,128C 'shut':68B,141C 'suppli':87C 'system':109C,127C,145C 'trigger':80C 'trust':102C 'unit':40B 'updat':8A,29B,99C,123C 'user':115C,133C 'whatev':39B","nicknames":[],"mitigations":[],"who_affected":"Hosts that run Podman and use its auto-update feature on container images from sources that are not fully trusted, especially when Podman runs as root. Systems that do not use auto-update, or that only pull images they build and control, are unlikely to be exposed. The sources do not name fixed versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["containers","linux","medium","podman","runtime","selfhosted"],"campaign_type":null,"search_a":"'-121885':14A,17A '-2026':13A,16A 'arbitrari':10A 'auto':7A 'auto-upd':6A 'craft':2A 'cve':12A,15A 'imag':3A 'label':4A 'let':5A 'podman':1A 'restart':9A 'servic':11A 'updat':8A","search_b":"'administr':65B 'auto':28B 'auto-upd':27B 'caus':55B 'contain':18B,34B 'craft':45B 'denial':57B 'host':24B,50B,70B 'imag':35B,46B 'label':36B,42B 'linux':19B 'make':48B 'name':32B,43B 'podman':20B,25B,62B 'privileg':66B 'read':30B 'restart':38B,52B 'run':63B 'runtim':21B 'self':23B 'self-host':22B 'servic':31B,51B,59B 'shut':68B 'unit':40B 'updat':29B 'whatev':39B","search_c":"'administr':150C 'allow':137C 'arbitrari':126C 'attack':78C,139C 'auto':98C,122C 'auto-upd':97C,121C 'contain':89C,91C,119C 'craft':92C 'denial':82C 'determin':107C 'dos':85C 'flaw':72C 'found':74C 'host':144C 'imag':90C,104C 'improp':101C 'label':94C,105C 'malici':118C 'mechan':100C 'metadata':93C 'podman':76C,95C,147C 'potenti':136C 'privileg':135C,151C 'process':124C 'restart':112C,130C 'run':116C,148C 'servic':84C,110C,128C 'shut':141C 'suppli':87C 'system':109C,127C,145C 'trigger':80C 'trust':102C 'updat':99C,123C 'user':115C,133C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T15:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121885","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121885","severity":null,"published_at":"2026-11-10T15:17:15+00:00","modified_at":"2026-11-10T15:17:15+00:00","first_seen_at":"2026-11-10T15:22:22+00:00","fetched_at":"2026-11-10T15:22:22+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}