RHSA-2026:93464: Moderate: podman security update

Q: What action must an attacker be able to induce for this issue to be exploited?

The issue is triggered when Podman imports an OCI archive. Exploitation therefore requires a malicious OCI archive to be imported by the affected Podman environment.

Q: Which installed components are covered by this update?

The advisory covers podman and related packages including podman-remote, podman-docker, podman-tests, debuginfo packages, and debugsource packages listed in the advisory.

Q: What should teams prioritize when patching cannot happen immediately?

Avoid importing OCI archives from untrusted sources until the security update can be applied. The provided data identifies arbitrary file write during OCI archive import as the affected operation.

Published Nov 2, 2026

Updated

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.Security Fix(es): podman: Arbitrary file write when importing OCI archive (CVE-2025-11395) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

29 affected componentsFixes available

redhat/podman<5.8.2-12.el10_2

5.8.2-12.el10_2

redhat/podman<5.8.2-12.el10_2

5.8.2-12.el10_2

redhat/podman-debuginfo<5.8.2-12.el10_2

5.8.2-12.el10_2

redhat/podman-debugsource<5.8.2-12.el10_2

5.8.2-12.el10_2

redhat/podman-docker<5.8.2-12.el10_2

5.8.2-12.el10_2

redhat/podman-remote<5.8.2-12.el10_2

5.8.2-12.el10_2

redhat/podman-remote-debuginfo<5.8.2-12.el10_2

5.8.2-12.el10_2

redhat/podman-tests-debuginfo<5.8.2-12.el10_2

5.8.2-12.el10_2

redhat/podman-debuginfo<5.8.2-12.el10_2

5.8.2-12.el10_2

redhat/podman-debugsource<5.8.2-12.el10_2

5.8.2-12.el10_2

redhat/podman-remote<5.8.2-12.el10_2

5.8.2-12.el10_2

redhat/podman-remote-debuginfo<5.8.2-12.el10_2

5.8.2-12.el10_2

redhat/podman-tests-debuginfo<5.8.2-12.el10_2

5.8.2-12.el10_2

redhat/podman<5.8.2-12.el10_2

5.8.2-12.el10_2

redhat/podman-debuginfo<5.8.2-12.el10_2

5.8.2-12.el10_2

redhat/podman-debugsource<5.8.2-12.el10_2

5.8.2-12.el10_2

redhat/podman-remote<5.8.2-12.el10_2

5.8.2-12.el10_2

redhat/podman-remote-debuginfo<5.8.2-12.el10_2

5.8.2-12.el10_2

redhat/podman-tests-debuginfo<5.8.2-12.el10_2

5.8.2-12.el10_2

redhat/podman<5.8.2-12.el10_2.aa

5.8.2-12.el10_2.aa

redhat/podman-debuginfo<5.8.2-12.el10_2.aa

5.8.2-12.el10_2.aa

redhat/podman-debugsource<5.8.2-12.el10_2.aa

5.8.2-12.el10_2.aa

redhat/podman-remote<5.8.2-12.el10_2.aa

5.8.2-12.el10_2.aa

redhat/podman-remote-debuginfo<5.8.2-12.el10_2.aa

5.8.2-12.el10_2.aa

redhat/podman-tests-debuginfo<5.8.2-12.el10_2.aa

5.8.2-12.el10_2.aa

redhat/podman-tests<5.8.2-12.el10_2

5.8.2-12.el10_2

redhat/podman-tests<5.8.2-12.el10_2

5.8.2-12.el10_2

redhat/podman-tests<5.8.2-12.el10_2.aa

5.8.2-12.el10_2.aa

redhat/podman-tests<5.8.2-12.el10_2

5.8.2-12.el10_2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/podman to a version that resolves this vulnerability.
Fixed in 5.8.2-12.el10_2
Upgrade
Upgrade redhat/podman-debuginfo to a version that resolves this vulnerability.
Fixed in 5.8.2-12.el10_2
Upgrade
Upgrade redhat/podman-debugsource to a version that resolves this vulnerability.
Fixed in 5.8.2-12.el10_2
Upgrade
Upgrade redhat/podman-docker to a version that resolves this vulnerability.
Fixed in 5.8.2-12.el10_2
Upgrade
Upgrade redhat/podman-remote to a version that resolves this vulnerability.
Fixed in 5.8.2-12.el10_2
Upgrade
Upgrade redhat/podman-remote-debuginfo to a version that resolves this vulnerability.
Fixed in 5.8.2-12.el10_2
Upgrade
Upgrade redhat/podman-tests-debuginfo to a version that resolves this vulnerability.
Fixed in 5.8.2-12.el10_2
Upgrade
Upgrade redhat/podman to a version that resolves this vulnerability.
Fixed in 5.8.2-12.el10_2.aa
Upgrade
Upgrade redhat/podman-debuginfo to a version that resolves this vulnerability.
Fixed in 5.8.2-12.el10_2.aa
Upgrade
Upgrade redhat/podman-debugsource to a version that resolves this vulnerability.
Fixed in 5.8.2-12.el10_2.aa
Upgrade
Upgrade redhat/podman-remote to a version that resolves this vulnerability.
Fixed in 5.8.2-12.el10_2.aa
Upgrade
Upgrade redhat/podman-remote-debuginfo to a version that resolves this vulnerability.
Fixed in 5.8.2-12.el10_2.aa
Upgrade
Upgrade redhat/podman-tests-debuginfo to a version that resolves this vulnerability.
Fixed in 5.8.2-12.el10_2.aa
Upgrade
Upgrade redhat/podman-tests to a version that resolves this vulnerability.
Fixed in 5.8.2-12.el10_2
Upgrade
Upgrade redhat/podman-tests to a version that resolves this vulnerability.
Fixed in 5.8.2-12.el10_2.aa

Event History

Nov 2, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Frequently Asked Questions

What action must an attacker be able to induce for this issue to be exploited?

The issue is triggered when Podman imports an OCI archive. Exploitation therefore requires a malicious OCI archive to be imported by the affected Podman environment.

Which installed components are covered by this update?

The advisory covers podman and related packages including podman-remote, podman-docker, podman-tests, debuginfo packages, and debugsource packages listed in the advisory.

What should teams prioritize when patching cannot happen immediately?

Avoid importing OCI archives from untrusted sources until the security update can be applied. The provided data identifies arbitrary file write during OCI archive import as the affected operation.

RHSA-2026:93464: Moderate: podman security update

Affected Software

Remediation

Event History

Frequently Asked Questions

What action must an attacker be able to induce for this issue to be exploited?

Which installed components are covered by this update?

What should teams prioritize when patching cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

What action must an attacker be able to induce for this issue to be exploited?

Which installed components are covered by this update?

What should teams prioritize when patching cannot happen immediately?