{"id":"CVE-2026-57231","kind":"vulnerability","aliases":["CVE-2026-57231","GHSA-4hq8-gpf5-8p68","GO-2026-6594"],"related":[],"title":"Podman: Malformed Image can trick podman run into leaking host environment variables into the container in github.com/containers/libpod","description":"Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk (*) will cause podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all podman environment variables that are set in the session from where the container is launched. This vulnerability is fixed in 5.8.4 and 6.0.0.","summary":"Podman, the OCI container tool, passes host environment variables into a container when the container image declares a variable with a key but no value, and a wildcard setting can pass all of them. A malicious image can therefore read secrets such as tokens and keys that were set in the shell where podman run was launched.","severity":"high","cvss":7.5,"epss":0.00437,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/containers/libpod","fixed":[],"affected":">= 1.8.1","ecosystem":"go"},{"name":"github.com/containers/podman","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/containers/podman/v2","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/containers/podman/v3","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/containers/podman/v4","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/containers/podman/v5","fixed":["5.8.4"],"affected":"< 5.8.4","ecosystem":"go"},{"name":"go.podman.io/podman/v6","fixed":["6.0.0"],"affected":"< 6.0.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["ci-runners","containers","go","package","podman","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"Run podman version and check whether it is 5.8.3 or older (or any 6.x below 6.0.0) on the v5 or v6 line, or any version of the v1 to v4 Go modules that depends on it.\nReview which images you run with podman run, especially third-party or untrusted ones, and what variables the launching shell exports.","fix":"Upgrade Podman to 5.8.4 or 6.0.0 or later.\nUntil then, run only trusted images and avoid exporting secrets in the shell that launches podman run.","status":"open","published_at":"2026-06-26T17:16:34+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:45:40+00:00","updated_at":"2026-10-23T21:45:40+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:45:40Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Podman to 5.8.4 or 6.0.0 or later.\nUntil then, run only trusted images and avoid exporting secrets in the shell that launches podman run.","reach":"local","impact":"high","summary":"Podman, the OCI container tool, passes host environment variables into a container when the container image declares a variable with a key but no value, and a wildcard setting can pass all of them. A malicious image can therefore read secrets such as tokens and keys that were set in the shell where podman run was launched.","category":"package","who_cares":["podman","go","containers","ci-runners","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"A malicious image can read all host environment variables, exposing secrets from the launching session.","analyst_note":"","how_to_check":"Run podman version and check whether it is 5.8.3 or older (or any 6.x below 6.0.0) on the v5 or v6 line, or any version of the v1 to v4 Go modules that depends on it.\nReview which images you run with podman run, especially third-party or untrusted ones, and what variables the launching shell exports.\nunknown","needs_analyst":false,"not_affected_if":["default-config"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000537,"input_tokens":3154,"output_tokens":444,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':21A,29A,32A '-57231':22A,33A '-6594':30A '/containers/libpod':19A,36A '/containers/podman':39A '/containers/podman/v2':42A '/containers/podman/v3':45A '/containers/podman/v4':48A '/containers/podman/v5':51A '/podman/v6':54A '1.8.1':133C '4hq8':25A '5.8.4':135C,214C '6.0.0':216C '8p68':27A 'asterisk':174C 'caus':176C 'ci':56B 'ci-runn':55B 'contain':15A,58B,68B,76B,79B,129C,137C,140C,163C,185C,206C 'cve':20A,31A 'declar':81B 'environ':11A,72B,142C,195C 'essenti':187C 'exfiltr':192C 'fact':170C 'fix':212C 'ghsa':24A 'ghsa-4hq8-gpf5-8p68':23A 'github.com':18A,35A,38A,41A,44A,47A,50A 'github.com/containers/libpod':17A,34A 'github.com/containers/podman':37A 'github.com/containers/podman/v2':40A 'github.com/containers/podman/v3':43A 'github.com/containers/podman/v4':46A 'github.com/containers/podman/v5':49A 'go':28A,59B 'go.podman.io':53A 'go.podman.io/podman/v6':52A 'gpf5':26A 'host':10A,64B,71B,160C,181C 'imag':3A,80B,101B,138C,190C 'key':86B,110B,147C 'launch':121B,208C 'leak':9A 'made':166C 'malform':2A 'malici':100B,189C 'manag':127C 'oci':67B,128C 'packag':60B 'pass':70B,95B,155C,179C 'pod':131C 'podman':1A,6A,61B,65B,118B,122C,153C,177C,194C 'read':104B 'run':7A,119B 'runner':57B 'secret':105B 'self':63B 'self-host':62B 'session':202C 'set':93B,113B,199C 'shell':116B 'therefor':103B 'token':108B 'tool':69B,125C 'trick':5A,152C 'use':172C 'valu':89B,150C 'variabl':12A,73B,83B,143C,157C,182C,196C 'vulner':210C 'wildcard':92B 'wors':167C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-26T17:16:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6594","url":"https://pkg.go.dev/vuln/GO-2026-6594","severity":null,"published_at":"2026-10-01T20:23:38+00:00","modified_at":"2026-10-01T20:23:38+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-57231","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57231","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-57231","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57231","severity":null,"published_at":"2026-06-26T17:16:34+00:00","modified_at":"2026-07-06T13:30:12+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}