01 Record

CVE-2026-57231

Podman: Malformed Image can trick podman run into leaking host environment variables into the container

HighPUBLISHEDCNA: GitHub_M

CNA base score7.5 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

View raw JSON

02 Description

Podman: Malformed Image can trick podman run into leaking host environment variables into the container

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.43% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 37.6% of scored records. A rank, not a probability.

NVD base score

7.5 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD analysis status

Analyzed. NVD last modified this record on 2026-10-25.

Red Hat severity

Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-06-26 16:29Z4 MO AGO

Last updated

2026-06-27 02:41Z4 MO AGO

Reserved

2026-06-24

Assigning CNA

GitHub_M

Record state

PUBLISHED

Severity

High (CVSS 7.5)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-200Exposure of Sensitive Information to an Unauthorized ActorClass
CWE-668Exposure of Resource to Wrong SphereClass
CWE-914Improper Control of Dynamically-Identified VariablesBase

Data version

5.2

Document digest

325ce86d6d2c0553fb8b4edbcd6e0ab9df5d2f476295f09c62aaa38b68ba708b

05 Affected products

VendorProductVersionsPlatforms

podman-container-toolspodman>= 1.8.1, < 5.8.4—

06 References

github.comhttps://github.com/podman-container-tools/podman/security/advisories/GHSA-4hq8-gpf5-8p68x_refsource_CONFIRM
github.comhttps://github.com/podman-container-tools/podman/commit/6c431b73dbf8e4b20b778644d7a80caebdb75050x_refsource_MISC

07 Fixed in

AlmaLinux 8

aardvark-dns
Fixed

A version is affected if any line below covers it.
- Affected before 2:1.10.1-2.module_el8.10.0+3901+4b80ecd7
- Affected before 2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7
- Affected before 2:1.10.1-2.module_el8.10.0+4047+545787c4
- Affected before 2:1.10.1-2.module_el8.10.0+4089+ce72bbbe
buildah
Fixed in 2:1.33.14-4.module_el8.10.0+4213+0493256b
buildah-tests
Fixed in 2:1.33.14-4.module_el8.10.0+4213+0493256b
cockpit-podman
Fixed in 84.1-1.module_el8.10.0+4102+6c76e544
conmon
Fixed

A version is affected if any line below covers it.
- Affected before 3:2.1.10-1.module_el8.10.0+3970+8445edf6
- Affected before 3:2.1.10-1.module_el8.10.0+4068+0e21408f
- Affected before 3:2.1.10-1.module_el8.10.0+4090+91932338
container-selinux
Fixed in 2:2.229.0-3.module_el8.10.0+4213+0493256b
containernetworking-plugins
Fixed in 1:1.4.0-8.module_el8.10.0+4136+16425343
containers-common
Fixed

A version is affected if any line below covers it.
- Affected before 2:1-82.module_el8.10.0+3876+e55593a8
- Affected before 2:1-82.module_el8.10.0+3901+4b80ecd7
- Affected before 2:1-82.module_el8.10.0+4089+ce72bbbe
crit
Fixed

A version is affected if any line below covers it.
- Affected before 3.18-5.module_el8.10.0+3845+87b84552
- Affected before 3.18-5.module_el8.10.0+3901+4b80ecd7
- Affected before 3.18-5.module_el8.10.0+4047+545787c4
- Affected before 3.18-5.module_el8.10.0+4120+03ad4b47
criu
Fixed

A version is affected if any line below covers it.
- Affected before 3.18-5.module_el8.10.0+3876+e55593a8
- Affected before 3.18-5.module_el8.10.0+3909+6e1c1eb7
- Affected before 3.18-5.module_el8.10.0+4089+ce72bbbe
- Affected before 3.18-5.module_el8.10.0+4120+03ad4b47
criu-devel
Fixed

A version is affected if any line below covers it.
- Affected before 3.18-5.module_el8.10.0+3858+6ad51f9f
- Affected before 3.18-5.module_el8.10.0+4016+efd18bf8
- Affected before 3.18-5.module_el8.10.0+4068+0e21408f
- Affected before 3.18-5.module_el8.10.0+4089+ce72bbbe
criu-libs
Fixed

A version is affected if any line below covers it.
- Affected before 3.18-5.module_el8.10.0+3909+6e1c1eb7
- Affected before 3.18-5.module_el8.10.0+3926+f12484f5
- Affected before 3.18-5.module_el8.10.0+3970+8445edf6
- Affected before 3.18-5.module_el8.10.0+4082+f7f0c95e
crun
Fixed

A version is affected if any line below covers it.
- Affected before 1.14.3-2.module_el8.10.0+4082+f7f0c95e
- Affected before 1.14.3-2.module_el8.10.0+4102+6c76e544
- Affected before 1.14.3-2.module_el8.10.0+4120+03ad4b47
fuse-overlayfs
Fixed

A version is affected if any line below covers it.
- Affected before 1.13-1.module_el8.10.0+3792+03eaed9c
- Affected before 1.13-1.module_el8.10.0+4047+545787c4
- Affected before 1.13-1.module_el8.10.0+4068+0e21408f
- Affected before 1.13-1.module_el8.10.0+4082+f7f0c95e
libslirp
Fixed

A version is affected if any line below covers it.
- Affected before 4.4.0-2.module_el8.10.0+4023+db236c53
- Affected before 4.4.0-2.module_el8.10.0+4089+ce72bbbe
- Affected before 4.4.0-2.module_el8.10.0+4090+91932338
- Affected before 4.4.0-2.module_el8.10.0+4120+03ad4b47
libslirp-devel
Fixed

A version is affected if any line below covers it.
- Affected before 4.4.0-2.module_el8.10.0+3970+8445edf6
- Affected before 4.4.0-2.module_el8.10.0+4068+0e21408f
- Affected before 4.4.0-2.module_el8.10.0+4082+f7f0c95e
- Affected before 4.4.0-2.module_el8.10.0+4102+6c76e544
netavark
Fixed

A version is affected if any line below covers it.
- Affected before 2:1.10.3-1.module_el8.10.0+3970+8445edf6
- Affected before 2:1.10.3-1.module_el8.10.0+4023+db236c53
- Affected before 2:1.10.3-1.module_el8.10.0+4082+f7f0c95e
- Affected before 2:1.10.3-1.module_el8.10.0+4120+03ad4b47
oci-seccomp-bpf-hook
Fixed

A version is affected if any line below covers it.
- Affected before 1.2.10-1.module_el8.10.0+3909+6e1c1eb7
- Affected before 1.2.10-1.module_el8.10.0+4047+545787c4
- Affected before 1.2.10-1.module_el8.10.0+4068+0e21408f
- Affected before 1.2.10-1.module_el8.10.0+4120+03ad4b47
podman
Fixed in 4:4.9.4-34.module_el8.10.0+4227+f1240cfc
podman-catatonit
Fixed in 4:4.9.4-34.module_el8.10.0+4227+f1240cfc
podman-docker
Fixed in 4:4.9.4-34.module_el8.10.0+4227+f1240cfc
podman-gvproxy
Fixed in 4:4.9.4-34.module_el8.10.0+4227+f1240cfc
podman-plugins
Fixed in 4:4.9.4-34.module_el8.10.0+4227+f1240cfc
podman-remote
Fixed in 4:4.9.4-34.module_el8.10.0+4227+f1240cfc
podman-tests
Fixed in 4:4.9.4-34.module_el8.10.0+4227+f1240cfc
python3-criu
Fixed

A version is affected if any line below covers it.
- Affected before 3.18-5.module_el8.10.0+3876+e55593a8
- Affected before 3.18-5.module_el8.10.0+3901+4b80ecd7
- Affected before 3.18-5.module_el8.10.0+3970+8445edf6
- Affected before 3.18-5.module_el8.10.0+4120+03ad4b47
python3-podman
Fixed in 4.9.0-3.module_el8.10.0+4016+efd18bf8
runc
Fixed in 4:1.2.9-4.module_el8.10.0+4136+16425343
skopeo
Fixed in 2:1.14.6-2.module_el8.10.0+4211+49ea0979
skopeo-tests
Fixed in 2:1.14.6-2.module_el8.10.0+4211+49ea0979
slirp4netns
Fixed

A version is affected if any line below covers it.
- Affected before 1.2.3-1.module_el8.10.0+3926+f12484f5
- Affected before 1.2.3-1.module_el8.10.0+4023+db236c53
- Affected before 1.2.3-1.module_el8.10.0+4047+545787c4
- Affected before 1.2.3-1.module_el8.10.0+4082+f7f0c95e
toolbox
Fixed in 0.0.99.5.1-1.module_el8.10.0+4120+03ad4b47
toolbox-tests
Fixed in 0.0.99.5.1-1.module_el8.10.0+4120+03ad4b47
udica
Fixed in 0.2.6-21.module_el8.10.0+4068+0e21408f

AlmaLinux 9

podman
Fixed in 6:5.8.2-4.el9_8
podman-docker
Fixed in 6:5.8.2-4.el9_8
podman-plugins
Fixed in 6:5.8.2-4.el9_8
podman-remote
Fixed in 6:5.8.2-4.el9_8
podman-tests
Fixed in 6:5.8.2-4.el9_8

CloudLinux 8

aardvark-dns
Fixed

A version is affected if any line below covers it.
- Affected before 2:1.10.1-2.module_el8.10.0+3901+4b80ecd7
- Affected before 2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7
- Affected before 2:1.10.1-2.module_el8.10.0+4047+545787c4
- Affected before 2:1.10.1-2.module_el8.10.0+4089+ce72bbbe
buildah
Fixed in 2:1.33.14-4.module_el8.10.0+4213+0493256b
buildah-tests
Fixed in 2:1.33.14-4.module_el8.10.0+4213+0493256b
cockpit-podman
Fixed in 84.1-1.module_el8.10.0+4102+6c76e544
conmon
Fixed

A version is affected if any line below covers it.
- Affected before 3:2.1.10-1.module_el8.10.0+3970+8445edf6
- Affected before 3:2.1.10-1.module_el8.10.0+4068+0e21408f
- Affected before 3:2.1.10-1.module_el8.10.0+4090+91932338
container-selinux
Fixed in 2:2.229.0-3.module_el8.10.0+4213+0493256b
containernetworking-plugins
Fixed in 1:1.4.0-8.module_el8.10.0+4136+16425343
containers-common
Fixed

A version is affected if any line below covers it.
- Affected before 2:1-82.module_el8.10.0+3876+e55593a8
- Affected before 2:1-82.module_el8.10.0+3901+4b80ecd7
- Affected before 2:1-82.module_el8.10.0+4089+ce72bbbe
crit
Fixed

A version is affected if any line below covers it.
- Affected before 3.18-5.module_el8.10.0+3845+87b84552
- Affected before 3.18-5.module_el8.10.0+3901+4b80ecd7
- Affected before 3.18-5.module_el8.10.0+4047+545787c4
- Affected before 3.18-5.module_el8.10.0+4120+03ad4b47
criu
Fixed

A version is affected if any line below covers it.
- Affected before 3.18-5.module_el8.10.0+3876+e55593a8
- Affected before 3.18-5.module_el8.10.0+3909+6e1c1eb7
- Affected before 3.18-5.module_el8.10.0+4089+ce72bbbe
- Affected before 3.18-5.module_el8.10.0+4120+03ad4b47
criu-devel
Fixed

A version is affected if any line below covers it.
- Affected before 3.18-5.module_el8.10.0+3858+6ad51f9f
- Affected before 3.18-5.module_el8.10.0+4016+efd18bf8
- Affected before 3.18-5.module_el8.10.0+4068+0e21408f
- Affected before 3.18-5.module_el8.10.0+4089+ce72bbbe
criu-libs
Fixed

A version is affected if any line below covers it.
- Affected before 3.18-5.module_el8.10.0+3909+6e1c1eb7
- Affected before 3.18-5.module_el8.10.0+3926+f12484f5
- Affected before 3.18-5.module_el8.10.0+3970+8445edf6
- Affected before 3.18-5.module_el8.10.0+4082+f7f0c95e
crun
Fixed

A version is affected if any line below covers it.
- Affected before 1.14.3-2.module_el8.10.0+4082+f7f0c95e
- Affected before 1.14.3-2.module_el8.10.0+4102+6c76e544
- Affected before 1.14.3-2.module_el8.10.0+4120+03ad4b47
fuse-overlayfs
Fixed

A version is affected if any line below covers it.
- Affected before 1.13-1.module_el8.10.0+3792+03eaed9c
- Affected before 1.13-1.module_el8.10.0+4047+545787c4
- Affected before 1.13-1.module_el8.10.0+4068+0e21408f
- Affected before 1.13-1.module_el8.10.0+4082+f7f0c95e
libslirp
Fixed

A version is affected if any line below covers it.
- Affected before 4.4.0-2.module_el8.10.0+4023+db236c53
- Affected before 4.4.0-2.module_el8.10.0+4089+ce72bbbe
- Affected before 4.4.0-2.module_el8.10.0+4090+91932338
- Affected before 4.4.0-2.module_el8.10.0+4120+03ad4b47
libslirp-devel
Fixed

A version is affected if any line below covers it.
- Affected before 4.4.0-2.module_el8.10.0+3970+8445edf6
- Affected before 4.4.0-2.module_el8.10.0+4068+0e21408f
- Affected before 4.4.0-2.module_el8.10.0+4082+f7f0c95e
- Affected before 4.4.0-2.module_el8.10.0+4102+6c76e544
netavark
Fixed

A version is affected if any line below covers it.
- Affected before 2:1.10.3-1.module_el8.10.0+3970+8445edf6
- Affected before 2:1.10.3-1.module_el8.10.0+4023+db236c53
- Affected before 2:1.10.3-1.module_el8.10.0+4082+f7f0c95e
- Affected before 2:1.10.3-1.module_el8.10.0+4120+03ad4b47
oci-seccomp-bpf-hook
Fixed

A version is affected if any line below covers it.
- Affected before 1.2.10-1.module_el8.10.0+3909+6e1c1eb7
- Affected before 1.2.10-1.module_el8.10.0+4047+545787c4
- Affected before 1.2.10-1.module_el8.10.0+4068+0e21408f
- Affected before 1.2.10-1.module_el8.10.0+4120+03ad4b47
podman
Fixed in 4:4.9.4-34.module_el8.10.0+4227+f1240cfc
podman-catatonit
Fixed in 4:4.9.4-34.module_el8.10.0+4227+f1240cfc
podman-docker
Fixed in 4:4.9.4-34.module_el8.10.0+4227+f1240cfc
podman-gvproxy
Fixed in 4:4.9.4-34.module_el8.10.0+4227+f1240cfc
podman-plugins
Fixed in 4:4.9.4-34.module_el8.10.0+4227+f1240cfc
podman-remote
Fixed in 4:4.9.4-34.module_el8.10.0+4227+f1240cfc
podman-tests
Fixed in 4:4.9.4-34.module_el8.10.0+4227+f1240cfc
python3-criu
Fixed

A version is affected if any line below covers it.
- Affected before 3.18-5.module_el8.10.0+3876+e55593a8
- Affected before 3.18-5.module_el8.10.0+3901+4b80ecd7
- Affected before 3.18-5.module_el8.10.0+3970+8445edf6
- Affected before 3.18-5.module_el8.10.0+4120+03ad4b47
python3-podman
Fixed in 4.9.0-3.module_el8.10.0+4016+efd18bf8
runc
Fixed in 4:1.2.9-4.module_el8.10.0+4136+16425343
skopeo
Fixed in 2:1.14.6-2.module_el8.10.0+4211+49ea0979
skopeo-tests
Fixed in 2:1.14.6-2.module_el8.10.0+4211+49ea0979
slirp4netns
Fixed

A version is affected if any line below covers it.
- Affected before 1.2.3-1.module_el8.10.0+3926+f12484f5
- Affected before 1.2.3-1.module_el8.10.0+4023+db236c53
- Affected before 1.2.3-1.module_el8.10.0+4047+545787c4
- Affected before 1.2.3-1.module_el8.10.0+4082+f7f0c95e
toolbox
Fixed in 0.0.99.5.1-1.module_el8.10.0+4120+03ad4b47
toolbox-tests
Fixed in 0.0.99.5.1-1.module_el8.10.0+4120+03ad4b47
udica
Fixed in 0.2.6-21.module_el8.10.0+4068+0e21408f

Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.

CloudLinux 9

podman
Fixed in 6:5.8.2-4.el9_8
podman-docker
Fixed in 6:5.8.2-4.el9_8
podman-plugins
Fixed in 6:5.8.2-4.el9_8
podman-remote
Fixed in 6:5.8.2-4.el9_8
podman-tests
Fixed in 6:5.8.2-4.el9_8

Derived from AlmaLinux 9. Partial coverage: only packages taken from AlmaLinux 9 are listed.

Debian 13

podman
No fix yet

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

podman
Fixed in 5.8.4+ds1-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 25.10

podman
No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 26.04 LTS

podman
No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 26.10

podman
No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.