---
id: "CVE-2026-57231"
kind: "vulnerability"
aliases: ["CVE-2026-57231", "GHSA-4hq8-gpf5-8p68", "GO-2026-6594"]
title: "Podman: Malformed Image can trick podman run into leaking host environment variables into the container in github.com/containers/libpod"
severity: "high"
cvss: 7.5
epss: 0.00437
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/containers/libpod", "fixed": [], "affected": ">= 1.8.1", "ecosystem": "go"}, {"name": "github.com/containers/podman", "fixed": [], "affected": "all versions", "ecosystem": "go"}, {"name": "github.com/containers/podman/v2", "fixed": [], "affected": "all versions", "ecosystem": "go"}, {"name": "github.com/containers/podman/v3", "fixed": [], "affected": "all versions", "ecosystem": "go"}, {"name": "github.com/containers/podman/v4", "fixed": [], "affected": "all versions", "ecosystem": "go"}, {"name": "github.com/containers/podman/v5", "fixed": ["5.8.4"], "affected": "< 5.8.4", "ecosystem": "go"}, {"name": "go.podman.io/podman/v6", "fixed": ["6.0.0"], "affected": "< 6.0.0", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["ci-runners", "containers", "go", "package", "podman", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-06-26T17:16:34+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:45:40+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6594", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-57231", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57231", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Podman: Malformed Image can trick podman run into leaking host environment variables into the container in github.com/containers/libpod

Podman, the OCI container tool, passes host environment variables into a container when the container image declares a variable with a key but no value, and a wildcard setting can pass all of them. A malicious image can therefore read secrets such as tokens and keys that were set in the shell where podman run was launched.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/containers/libpod affected >= 1.8.1 fixed ?
- go:github.com/containers/podman affected all versions fixed ?
- go:github.com/containers/podman/v2 affected all versions fixed ?
- go:github.com/containers/podman/v3 affected all versions fixed ?
- go:github.com/containers/podman/v4 affected all versions fixed ?
- go:github.com/containers/podman/v5 affected < 5.8.4 fixed 5.8.4
- go:go.podman.io/podman/v6 affected < 6.0.0 fixed 6.0.0

## How to check

Run podman version and check whether it is 5.8.3 or older (or any 6.x below 6.0.0) on the v5 or v6 line, or any version of the v1 to v4 Go modules that depends on it.
Review which images you run with podman run, especially third-party or untrusted ones, and what variables the launching shell exports.

## Fix

Upgrade Podman to 5.8.4 or 6.0.0 or later.
Until then, run only trusted images and avoid exporting secrets in the shell that launches podman run.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6594
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-57231
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-57231

## From the sources

Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk (*) will cause podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all podman environment variables that are set in the session from where the container is launched. This vulnerability is fixed in 5.8.4 and 6.0.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_