CVE-2026-55686

Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path contains a symlink can create a directory or modify ownership on the host filesystem. Modified ownership is less likely to happen as that requires help from an untrusted/malicious process that mutates the host filesystem tree during dereferencing of the WORKDIR path, to trigger a race condition. This vulnerability is fixed in 5.7.1.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/podman-container-tools/podman/commit/d18e44e9abb3bf5b7294aa70806e1368fdddfdd0	Patch
https://github.com/podman-container-tools/podman/security/advisories/GHSA-q6r4-3wmg-fwcq	Exploit Patch Vendor Advisory
https://github.com/podman-container-tools/podman/security/advisories/GHSA-q6r4-3wmg-fwcq	Exploit Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:podman_project:podman:*:*:*:*:*:*:*:*

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Podman es una herramienta para gestionar contenedores OCI y pods. Desde la versión 3.0.0 hasta la 5.7.1, ejecutar una imagen de contenedor maliciosa donde la ruta WORKDIR contiene un enlace simbólico (symlink) puede crear un directorio o modificar la propiedad en el sistema de archivos del host. La modificación de la propiedad es menos probable que ocurra, ya que requiere la ayuda de un proceso no confiable/malicioso que muta el árbol del sistema de archivos del host durante la desreferenciación de la ruta WORKDIR, para desencadenar una condición de carrera. Esta vulnerabilidad está corregida en la versión 5.7.1.

Information

Published : 2026-06-26 17:16

Updated : 2026-10-25 17:10

NVD link : CVE-2026-55686

Mitre link : CVE-2026-55686

CVE.ORG link : CVE-2026-55686

JSON object : View

Products Affected

podman_project

podman

CWE

CWE-61

UNIX Symbolic Link (Symlink) Following

{"id": "CVE-2026-55686", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55686", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T18:31:12.071003Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "podman-container-tools", "product": "podman", "versions": [{"status": "affected", "version": ">= 3.0.0, < 5.7.1"}]}]}], "published": "2026-06-26T17:16:34.330", "references": [{"url": "https://github.com/podman-container-tools/podman/commit/d18e44e9abb3bf5b7294aa70806e1368fdddfdd0", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/podman-container-tools/podman/security/advisories/GHSA-q6r4-3wmg-fwcq", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/podman-container-tools/podman/security/advisories/GHSA-q6r4-3wmg-fwcq", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-61"}]}], "descriptions": [{"lang": "en", "value": "Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path contains a symlink can create a directory or modify ownership on the host filesystem. Modified ownership is less likely to happen as that requires help from an untrusted/malicious process that mutates the host filesystem tree during dereferencing of the WORKDIR path, to trigger a race condition. This vulnerability is fixed in 5.7.1."}, {"lang": "es", "value": "Podman es una herramienta para gestionar contenedores OCI y pods. Desde la versi\u00f3n 3.0.0 hasta la 5.7.1, ejecutar una imagen de contenedor maliciosa donde la ruta WORKDIR contiene un enlace simb\u00f3lico (symlink) puede crear un directorio o modificar la propiedad en el sistema de archivos del host. La modificaci\u00f3n de la propiedad es menos probable que ocurra, ya que requiere la ayuda de un proceso no confiable/malicioso que muta el \u00e1rbol del sistema de archivos del host durante la desreferenciaci\u00f3n de la ruta WORKDIR, para desencadenar una condici\u00f3n de carrera. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 5.7.1."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:podman_project:podman:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62FDCF49-B6FD-4F79-9101-8920CF9CC3D3", "versionEndExcluding": "5.7.1", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}