Description
Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| podman-container-tools | podman | >= 4.4.0, < 5.8.8, >= 6.0.0, < 6.1.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | podman | 5.8.6+ds1-3 | — |
| Debian 13 | podman | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | podman | No fix yet | — |
| Ubuntu 26.04 LTS | podman | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | podman +3 | 7:5.8.2-10.el10_2 | RHSA-2026:88202 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.8 EUS | podman +4 | 6:5.8.2-10.el9_8 | RHSA-2026:99093 |
| Red Hat Hardened Images 1 | podman +4 | 6.1.3-1.hum1 | RHSA-2026:74861, RHSA-2026:74178 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | podman +3 | 7:5.8.2-10.el10_2.alma.1 | ALSA-2026:88202 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | podman | 6.1.4-1.1 | openSUSE-SU-2026:12370-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | podman | 5.8.8-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | podman +1 | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | podman +3 | 7:5.8.2-10.0.1.el10_2 | ELSA-2026-88202 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | falco-no-driver | 0.45.0-r9 | — |
| Wolfi rolling | podman-6.0 | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/containers/podman | all versions | — | GO-2026-6770 |
| Go | github.com/containers/podman/v2 | all versions | — | GO-2026-6770 |
| Go | github.com/containers/podman/v3 | all versions | — | GO-2026-6770 |
| Go | github.com/containers/podman/v4 | >= 4.4.0, < 5.8.8 | 5.8.8 | GHSA-2cvf-wqm6-wr9g |
| Go | github.com/containers/podman/v4 | >= 4.4.0 | — | GO-2026-6770 |
| Go | github.com/containers/podman/v5 | >= 4.4.0, < 5.8.8 | 5.8.8 | GHSA-2cvf-wqm6-wr9g |
| Go | github.com/containers/podman/v5 | < 5.8.8 | 5.8.8 | GO-2026-6770 |
| Go | go.podman.io/podman/v6 | >= 6.0.0, < 6.1.3 | 6.1.3 | GHSA-2cvf-wqm6-wr9g |
Advisories 8
- RHSA-2026:99093 Red Hat Security Advisory: podman security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:88202 Red Hat Security Advisory: podman security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:74178 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-3651 Podman: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Nov 11, 2026
- openSUSE-SU-2026:12370-1 podman-6.1.4-1.1 on GA media SUSE / openSUSE Security Updates · Oct 31, 2026
- ALSA-2026:88202 Important: podman security update AlmaLinux Security Advisories · Oct 29, 2026
- ELSA-2026-88202 Important: podman security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 22, 2026
- RHSA-2026:74861 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
References
- https://github.com/podman-container-tools/podman/security/advisories/GHSA-2cvf-wqm6-wr9g
- https://github.com/podman-container-tools/podman/commit/24706290d5c974f078d8ca284026802515f28e92
- https://github.com/podman-container-tools/podman/commit/3721ff82ffb44a4ceeaecc5abd3808e924a6b669
- https://github.com/podman-container-tools/podman/commit/450c64426dbcff1097d3c7911d791101e3d16f4c
- https://github.com/podman-container-tools/podman/commit/7728ba0a90094408ad9078e36c3622a651d49616
- https://github.com/podman-container-tools/podman/commit/c74b1d37b3fb834b0de43e176565d9d8c254b627
- https://github.com/podman-container-tools/podman/commit/ea9243e04d1db3886dc3a51ee3300ffb547cfc02
- https://github.com/podman-container-tools/podman/releases/tag/v5.8.8
- https://github.com/podman-container-tools/podman/releases/tag/v6.1.3