AZL-113342: CVE-2026-121885 affecting package podman 5.6.1-10
A flaw was found in Podman. An attacker can trigger a Denial of Service (DoS) by supplying a container image containing crafted metadata labels. Podman's auto-update mechanism improperly trusts these image labels to determine which system services to restart. If a user runs the malicious container and auto-update processes it, arbitrary system services are restarted with the user's privileges, potentially allowing an attacker to shut down the host system when Podman runs with administrative privileges.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using Podman’s auto-update mechanism are exposed if a user runs a container image with crafted metadata labels and auto-update later processes that image. The impact can include host shutdown when Podman runs with administrative privileges.
What does an attacker need to exploit it?
An attacker needs to supply a container image containing crafted metadata labels and have a user run that malicious container. Podman’s auto-update processing must then act on the image labels.
What can happen if exploitation succeeds?
Podman may restart arbitrary system services using the user’s privileges. When Podman is running with administrative privileges, this can potentially be used to shut down the host system.