CVE-2026-94603: Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
podmanto a version that resolves this vulnerability.Fixed in 5.8.8 - Upgrade
Upgrade
podmanto a version that resolves this vulnerability.Fixed in 6.1.3
Event History
Frequently Asked Questions
Which deployments are exposed?
Podman installations running versions from 4.4.0 through versions before 5.8.8 or 6.1.3 are affected when running images that carry the io.podman.annotations.checkpoint.runtime.name annotation. Rootless containers are not affected because checkpoint and restore are unavailable in rootless mode.
What does an attacker need to exploit this issue?
An attacker needs to provide or convince an operator to run an image containing the checkpoint runtime-name annotation. Exploitation occurs through podman run and does not require privileges or user interaction beyond running that image.
Are explicitly supplied container hardening options reliable on affected versions?
No. For an annotated image treated as a checkpoint, podman run can silently ignore user-supplied creation restrictions, including --cap-drop=ALL, and use weaker sandbox settings and capabilities selected by the image-controlled checkpoint state.
What should be done if upgrading is possible?
Upgrade to Podman 5.8.8 or 6.1.3. These versions contain the fix.