UBUNTU-CVE-2026-121885: Medium severity ubuntu/podman vulnerability
A flaw was found in Podman. An attacker can trigger a Denial of Service (DoS) by supplying a container image containing crafted metadata labels. Podman's auto-update mechanism improperly trusts these image labels to determine which system services to restart. If a user runs the malicious container and auto-update processes it, arbitrary system services are restarted with the user's privileges, potentially allowing an attacker to shut down the host system when Podman runs with administrative privileges.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems are exposed if a user runs a container image with crafted metadata labels and Podman's auto-update mechanism later processes that image. The impact can include host shutdown when Podman runs with administrative privileges.
What does an attacker need to exploit it?
An attacker needs to provide a container image containing crafted metadata labels and have a user run that image. Podman's auto-update processing must then act on the image labels.
Are systems affected if auto-update is not used?
The described attack depends on Podman's auto-update mechanism processing the crafted image metadata labels. The provided information does not indicate impact when auto-update is not involved.
What can be done before a fix is available?
Avoid running untrusted container images, particularly images whose metadata labels have not been reviewed. Prevent Podman's auto-update mechanism from processing potentially malicious images, and avoid running Podman with administrative privileges where possible.