CVE-2026-57231

Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk (*) will cause podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all podman environment variables that are set in the session from where the container is launched. This vulnerability is fixed in 5.8.4 and 6.0.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/podman-container-tools/podman/commit/6c431b73dbf8e4b20b778644d7a80caebdb75050	Patch
https://github.com/podman-container-tools/podman/security/advisories/GHSA-4hq8-gpf5-8p68	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:podman_project:podman::::::::
	cpe:2.3:a:podman_project:podman:6.0.0:rc1::::::

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Podman es una herramienta para gestionar contenedores OCI y pods. Desde la versión 1.8.1 hasta la 5.8.4, una imagen de contenedor que contiene una variable de entorno con solo una clave y sin valor puede engañar a Podman para que pase esa variable del host al contenedor. Esto se agrava por el hecho de que usar un asterisco (*) hará que Podman pase todas las variables del host al contenedor. Así, esencialmente, una imagen maliciosa puede exfiltrar todas las variables de entorno de Podman que están configuradas en la sesión desde donde se lanza el contenedor. Esta vulnerabilidad está corregida en las versiones 5.8.4 y 6.0.0.

Information

Published : 2026-06-26 17:16

Updated : 2026-10-25 17:10

NVD link : CVE-2026-57231

Mitre link : CVE-2026-57231

CVE.ORG link : CVE-2026-57231

JSON object : View

Products Affected

podman_project

podman

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-668

Exposure of Resource to Wrong Sphere

{"id": "CVE-2026-57231", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57231", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-27T02:41:47.348825Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "podman-container-tools", "product": "podman", "versions": [{"status": "affected", "version": ">= 1.8.1, < 5.8.4"}]}]}], "published": "2026-06-26T17:16:34.697", "references": [{"url": "https://github.com/podman-container-tools/podman/commit/6c431b73dbf8e4b20b778644d7a80caebdb75050", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/podman-container-tools/podman/security/advisories/GHSA-4hq8-gpf5-8p68", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-668"}]}], "descriptions": [{"lang": "en", "value": "Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk (*) will cause podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all podman environment variables that are set in the session from where the container is launched. This vulnerability is fixed in 5.8.4 and 6.0.0."}, {"lang": "es", "value": "Podman es una herramienta para gestionar contenedores OCI y pods. Desde la versi\u00f3n 1.8.1 hasta la 5.8.4, una imagen de contenedor que contiene una variable de entorno con solo una clave y sin valor puede enga\u00f1ar a Podman para que pase esa variable del host al contenedor. Esto se agrava por el hecho de que usar un asterisco (*) har\u00e1 que Podman pase todas las variables del host al contenedor. As\u00ed, esencialmente, una imagen maliciosa puede exfiltrar todas las variables de entorno de Podman que est\u00e1n configuradas en la sesi\u00f3n desde donde se lanza el contenedor. Esta vulnerabilidad est\u00e1 corregida en las versiones 5.8.4 y 6.0.0."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:podman_project:podman:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C7D99B4B-8C58-47AD-BB57-A32E3044440F", "versionEndExcluding": "5.8.4", "versionStartIncluding": "1.8.1"}, {"criteria": "cpe:2.3:a:podman_project:podman:6.0.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8A3C450-FDBE-4DAD-A476-D09322BAA9FA"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}