CVE-2026-24835: Podman Desktop Extension System Vulnerable to Authentication Bypass
Podman Desktop is a graphical tool for developing on containers and Kubernetes. A critical authentication bypass vulnerability in Podman Desktop prior to version 1.25.1 allows any extension to completely circumvent permission checks and gain unauthorized access to all authentication sessions. The isAccessAllowed() function unconditionally returns true, enabling malicious extensions to impersonate any user, hijack authentication sessions, and access sensitive resources without authorization. This vulnerability affects all versions of Podman Desktop. Version 1.25.1 contains a patch for the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24835?
CVE-2026-24835 is classified as critical due to the potential for authentication bypass in Podman Desktop.
How do I fix CVE-2026-24835?
To resolve CVE-2026-24835, update Podman Desktop to version 1.25.1 or later.
What applications are affected by CVE-2026-24835?
CVE-2026-24835 affects Red Hat Podman Desktop versions prior to 1.25.1.
What is the impact of CVE-2026-24835?
The impact of CVE-2026-24835 allows unauthorized extensions to bypass permission checks, compromising security.
Is there a workaround for CVE-2026-24835?
No specific workarounds are recommended; the best course of action is to upgrade to the patched version.