CVE-2026-121885: Podman: untrusted image labels allow auto-update to restart arbitrary systemd units
A flaw was found in Podman. An attacker can trigger a Denial of Service (DoS) by supplying a container image containing crafted metadata labels. Podman's auto-update mechanism improperly trusts these image labels to determine which system services to restart. If a user runs the malicious container and auto-update processes it, arbitrary system services are restarted with the user's privileges, potentially allowing an attacker to shut down the host system when Podman runs with administrative privileges.
Other sources
A flaw was found in Podman's auto-update functionality in versions 1.8.2 through 6.1.4. Podman copies image labels into containers, and auto-update trusts the io.containers.autoupdate and PODMANSYSTEMDUNIT labels to determine whether a container should be updated and which systemd unit to restart. An attacker can supply a container image with crafted labels that, when run by a user and subsequently processed by auto-update, causes arbitrary systemd units to be restarted with that user's privileges. When Podman runs as root, targeting poweroff.target may shut down the host, resulting in a complete loss of availability.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using Podman auto-update are exposed if they run a container image with attacker-controlled labels and that container is later processed by auto-update. The affected Podman versions are 1.8.2 through 6.1.4.
What must an attacker do to trigger the impact?
The attacker must provide an image containing crafted io.containers.autoupdate and PODMAN_SYSTEMD_UNIT labels. A user must run that image, and Podman auto-update must subsequently process the resulting container.
What is the impact when Podman runs with administrative privileges?
Auto-update can restart arbitrary systemd units with the user's privileges. When Podman runs as root, an attacker can target poweroff.target and potentially shut down the host.
What can be done if patching is not immediately possible?
Do not run untrusted container images where their labels may be processed by Podman auto-update. In particular, avoid root-run Podman auto-update for containers created from untrusted images.