CVE-2026-57231

Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk (*) will cause podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all podman environment variables that are set in the session from where the container is launched. This vulnerability is fixed in 5.8.4 and 6.0.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/podman-container-tools/podman/commit/6c431b73dbf8e4b20b778644d7a80caebdb75050	Patch
https://github.com/podman-container-tools/podman/security/advisories/GHSA-4hq8-gpf5-8p68	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:podman_project:podman::::::::
	cpe:2.3:a:podman_project:podman:6.0.0:rc1::::::

History

No history.

Information

Published : 2026-06-26 17:16

Updated : 2026-07-06 13:30

NVD link : CVE-2026-57231

Mitre link : CVE-2026-57231

CVE.ORG link : CVE-2026-57231

JSON object : View

Products Affected

podman_project

podman

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-668

Exposure of Resource to Wrong Sphere

{"id": "CVE-2026-57231", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57231", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-27T02:41:47.348825Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "podman-container-tools", "product": "podman", "versions": [{"status": "affected", "version": ">= 1.8.1, < 5.8.4"}]}]}], "published": "2026-06-26T17:16:34.697", "references": [{"url": "https://github.com/podman-container-tools/podman/commit/6c431b73dbf8e4b20b778644d7a80caebdb75050", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/podman-container-tools/podman/security/advisories/GHSA-4hq8-gpf5-8p68", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-668"}]}], "descriptions": [{"lang": "en", "value": "Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk (*) will cause podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all podman environment variables that are set in the session from where the container is launched. This vulnerability is fixed in 5.8.4 and 6.0.0."}], "lastModified": "2026-07-06T13:30:12.470", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:podman_project:podman:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C7D99B4B-8C58-47AD-BB57-A32E3044440F", "versionEndExcluding": "5.8.4", "versionStartIncluding": "1.8.1"}, {"criteria": "cpe:2.3:a:podman_project:podman:6.0.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8A3C450-FDBE-4DAD-A476-D09322BAA9FA"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}