---
id: "CVE-2026-94603"
kind: "vulnerability"
aliases: ["CVE-2026-94603", "GHSA-2cvf-wqm6-wr9g", "GO-2026-6770"]
title: "Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation in github.com/containers/podman"
severity: "critical"
cvss: 10.0
epss: 0.00918
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/containers/podman", "fixed": [], "affected": "all versions", "ecosystem": "go"}, {"name": "github.com/containers/podman/v2", "fixed": [], "affected": "all versions", "ecosystem": "go"}, {"name": "github.com/containers/podman/v3", "fixed": [], "affected": "all versions", "ecosystem": "go"}, {"name": "github.com/containers/podman/v4", "fixed": [], "affected": ">= 4.4.0", "ecosystem": "go"}, {"name": "github.com/containers/podman/v5", "fixed": ["5.8.8"], "affected": "< 5.8.8", "ecosystem": "go"}, {"name": "go.podman.io/podman/v6", "fixed": ["6.1.3"], "affected": ">= 6.0.0, < 6.1.3", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["ci", "containers", "go", "package", "podman", "self-hosted"]
not_affected_if: ["no-untrusted-images", "rootless-only", "version-outside-range"]
published_at: "2026-10-13T17:17:49+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T19:50:14+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6770", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-94603", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94603", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation in github.com/containers/podman

Podman's podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied restrictions such as --cap-drop=ALL. An attacker who controls an image can get a container with weaker sandboxing and extra capabilities than the operator requested.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/containers/podman affected all versions fixed ?
- go:github.com/containers/podman/v2 affected all versions fixed ?
- go:github.com/containers/podman/v3 affected all versions fixed ?
- go:github.com/containers/podman/v4 affected >= 4.4.0 fixed ?
- go:github.com/containers/podman/v5 affected < 5.8.8 fixed 5.8.8
- go:go.podman.io/podman/v6 affected >= 6.0.0, < 6.1.3 fixed 6.1.3

## How to check

Run podman version and confirm whether the installed version is from 4.4.0 up to 5.8.8, or 6.0.0 up to 6.1.3.
Run podman image inspect <image> and look for the io.podman.annotations.checkpoint.runtime.name annotation on images you pull from outside your control.
Rootless containers are reported as not affected, so check whether root podman is in use.

## Fix

Upgrade podman to 5.8.8 for the v5 line or 6.1.3 for the v6 line.
For the v4 line and earlier Go module paths, the sources do not give a fixed version (unknown).

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6770
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-94603
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94603

## From the sources

Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_