Podman fixes a critical flaw that lets a container image switch off sandboxing
A critical vulnerability (CVE-2026-94603, CVSS 10) in Podman allows a crafted image to override the security restrictions a user sets when creating a container. It affects rootful installations from version 4.4.0 onwards and is fixed in versions 5.8.8 and 6.1.3.
What happened
The maintainers of Podman, the open-source tool for managing OCI containers and pods, have fixed CVE-2026-94603, which carries the maximum severity score (CVSS 10, critical). According to the Podman 5.8.8 release notes on GitHub, running podman run on a checkpoint image (any image carrying the io.podman.annotations.checkpoint.runtime.name annotation) could disable all sandboxing when the container was created, including sandboxing explicitly requested by the user.
In practice, Podman silently ignored security options such as --cap-drop=ALL and let the image itself choose the sandbox settings and capabilities granted to the container. Anyone who can get a prepared image with that annotation executed could therefore end up with a container far less restricted than intended.
Who is affected
According to the NVD description, Podman versions from 4.4.0 up to, but not including, 5.8.8 and 6.1.3 are affected, depending on the release branch. Rootless containers are not affected, because checkpoint and restore are unavailable in that mode.
The risk is highest where images pulled from public or third-party registries are run as root, such as CI servers, shared development platforms and production hosts.
Exploitation status
The flaw is not currently listed in CISA's KEV catalogue, so there is no confirmed active exploitation, and FIRST has not yet assigned an EPSS exploitation probability. Even so, the maximum severity rating and the low complexity of an attack make prompt patching advisable.
What to do
The fix comes with a breaking change: according to the Podman advisory, support for running checkpoint images with podman run has been removed, because checkpoints ignore user-specified security configuration and are very difficult to run safely. Check whether any internal process relies on this feature before rolling out the update.
- Upgrade Podman to version 5.8.8 or 6.1.3, depending on the branch you use.
- Identify hosts running rootful Podman between version 4.4.0 and the fixed releases.
- Until you upgrade, run containers in rootless mode wherever possible.
- Avoid running images of unknown origin as root, and use podman image inspect to check for the io.podman.annotations.checkpoint.runtime.name annotation.
- Review any workflows that use checkpoint images with podman run and adapt them to the new behaviour.
Sources
Affected technologies
Vulnerabilities (1)
| CVE | Severity | Active exploitation | Published | NVD status |
|---|---|---|---|---|
| CVE-2026-94603 | Critical (10) | — | 10/13/2026 | Awaiting Analysis |
Written automatically from NVD, CISA KEV and vendor advisory data. Always check affected versions and patches in the vendor's official advisory before acting.