{"id":"CVE-2026-94603","kind":"vulnerability","aliases":["CVE-2026-94603","GHSA-2cvf-wqm6-wr9g","GO-2026-6770"],"related":[],"title":"Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation in github.com/containers/podman","description":"Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3.","summary":"Podman's podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied restrictions such as --cap-drop=ALL. An attacker who controls an image can get a container with weaker sandboxing and extra capabilities than the operator requested.","severity":"critical","cvss":10.0,"epss":0.00918,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/containers/podman","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/containers/podman/v2","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/containers/podman/v3","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/containers/podman/v4","fixed":[],"affected":">= 4.4.0","ecosystem":"go"},{"name":"github.com/containers/podman/v5","fixed":["5.8.8"],"affected":"< 5.8.8","ecosystem":"go"},{"name":"go.podman.io/podman/v6","fixed":["6.1.3"],"affected":">= 6.0.0, < 6.1.3","ecosystem":"go"}],"ecosystems":["go"],"tags":["ci","containers","go","package","podman","self-hosted"],"not_affected_if":["no-untrusted-images","rootless-only","version-outside-range"],"how_to_check":"Run podman version and confirm whether the installed version is from 4.4.0 up to 5.8.8, or 6.0.0 up to 6.1.3.\nRun podman image inspect <image> and look for the io.podman.annotations.checkpoint.runtime.name annotation on images you pull from outside your control.\nRootless containers are reported as not affected, so check whether root podman is in use.","fix":"Upgrade podman to 5.8.8 for the v5 line or 6.1.3 for the v6 line.\nFor the v4 line and earlier Go module paths, the sources do not give a fixed version (unknown).","status":"open","published_at":"2026-10-13T17:17:49+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:50:14+00:00","updated_at":"2026-10-23T19:50:14+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T19:50:14Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade podman to 5.8.8 for the v5 line or 6.1.3 for the v6 line.\nFor the v4 line and earlier Go module paths, the sources do not give a fixed version (unknown).","summary":"Podman's podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied restrictions such as --cap-drop=ALL. An attacker who controls an image can get a container with weaker sandboxing and extra capabilities than the operator requested.","category":"package","who_cares":["podman","go","containers","self-hosted","ci"],"confidence":0.8,"analyst_note":"Fixed version for the v4 and unversioned module paths is unknown; check https://pkg.go.dev/vuln/GO-2026-6770 and the GHSA-2cvf-wqm6-wr9g advisory.","how_to_check":"Run podman version and confirm whether the installed version is from 4.4.0 up to 5.8.8, or 6.0.0 up to 6.1.3.\nRun podman image inspect <image> and look for the io.podman.annotations.checkpoint.runtime.name annotation on images you pull from outside your control.\nRootless containers are reported as not affected, so check whether root podman is in use.","needs_analyst":true,"not_affected_if":["rootless-only","no-untrusted-images","version-outside-range"],"severity_if_unknown":"critical"},"cost_usd":0.000492,"input_tokens":2403,"output_tokens":504,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':22A,30A,33A '-6770':31A '-94603':23A,34A '/containers/podman':20A,37A '/containers/podman/v2':40A '/containers/podman/v3':43A '/containers/podman/v4':46A '/containers/podman/v5':49A '/podman/v6':52A '2cvf':26A '4.4.0':119C '5.8.8':121C,184C '6.1.3':123C,186C 'affect':168C 'allow':151C 'almost':11A 'annot':16A,71B,132C 'attack':89B 'cap':85B,148C 'cap-drop':84B,147C 'capabl':103B,163C 'carri':68B,129C 'checkpoint':74B,135C,155C,170C 'ci':53B 'command':5A 'contain':54B,97B,115C,142C,165C 'control':91B,154C 'creation':143C 'cve':21A,32A 'disabl':10A 'drop':86B,149C 'extra':102B 'fix':181C 'get':95B 'ghsa':25A 'ghsa-2cvf-wqm6-wr9g':24A 'github.com':19A,36A,39A,42A,45A,48A 'github.com/containers/podman':18A,35A 'github.com/containers/podman/v2':38A 'github.com/containers/podman/v3':41A 'github.com/containers/podman/v4':44A 'github.com/containers/podman/v5':47A 'go':29A,55B 'go.podman.io':51A 'go.podman.io/podman/v6':50A 'host':60B 'ignor':77B,138C 'imag':15A,67B,93B,128C,153C 'image-control':152C 'instruct':8A 'io.podman.annotations.checkpoint.runtime.name':70B,131C 'issu':179C 'manag':113C 'mode':177C 'oci':114C 'oper':106B 'packag':56B 'pod':117C 'podman':1A,3A,57B,61B,63B,108C,124C 'request':107B 'restor':172C 'restrict':81B,144C 'rootless':164C 'run':4A,64B,125C 'sandbox':13A,100B,160C 'select':158C 'self':59B 'self-host':58B 'set':161C 'silent':76B,137C 'state':156C 'suppli':80B,141C 'tool':111C 'treat':65B,126C 'unavail':174C 'user':79B,140C 'user-suppli':78B,139C 'version':183C 'weaker':99B,159C 'wqm6':27A 'wr9g':28A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-13T17:17:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6770","url":"https://pkg.go.dev/vuln/GO-2026-6770","severity":null,"published_at":"2026-10-19T21:08:35+00:00","modified_at":"2026-10-19T21:08:35+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-94603","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94603","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-94603","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94603","severity":null,"published_at":"2026-10-13T17:17:49+00:00","modified_at":"2026-10-16T16:00:33+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}