CVE catalog

CVE-2026-57231

Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that va

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.44% · Oct 25, 2026

Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk (*) will cause podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all podman environment variables that are set in the session from where the container is launched. This vulnerability is fixed in 5.8.4 and 6.0.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpepodmanNot reported5.8.4fixed
CpepodmanNot reportedNot reportedunknown
Gogithub.com/containers/podman/v5Not reported5.8.4fixed
Gogo.podman.io/podman/v6Not reported6.0.0fixed
Gogithub.com/containers/podman/v4Not reportedNot reportedunknown
Gogithub.com/containers/podman/v3Not reportedNot reportedunknown
Gogithub.com/containers/podman/v2Not reportedNot reportedunknown
Gogithub.com/containers/podmanNot reportedNot reportedunknown
Debianpodman135.4.2+ds1-2vulnerable
Debianpodman135.6.1+ds1-1vulnerable
Debianpodman135.6.1+ds1-2vulnerable
Debianpodman135.6.1+ds2-2vulnerable
Debianpodman135.6.1+ds2-3vulnerable
Debianpodman135.6.2+ds1-1vulnerable
Debianpodman135.6.2+ds1-2vulnerable
Debianpodman135.6.2+ds1-3vulnerable
Debianpodman135.6.2+ds1-3+exp1vulnerable
Debianpodman135.6.2+ds1-4vulnerable
Debianpodman135.7.0+ds2-1vulnerable
Debianpodman135.7.0+ds2-2vulnerable
Debianpodman135.7.0+ds2-3vulnerable
Debianpodman135.8.0+ds1-1vulnerable
Debianpodman135.8.1+ds1-1vulnerable
Debianpodman135.8.1+ds1-2vulnerable
Debianpodman135.8.1+ds1-3vulnerable
Debianpodman135.8.2+ds1-1vulnerable
Debianpodman135.8.2+ds1-2vulnerable
Debianpodman135.8.2+ds1-3vulnerable
Debianpodman135.8.3+ds1-1vulnerable
Debianpodman135.8.4+ds1-1vulnerable
Debianpodman135.8.4+ds1-2vulnerable
Debianpodman135.8.6+ds1-1vulnerable
Debianpodman135.8.6+ds1-2vulnerable
Debianpodman135.8.6+ds1-3vulnerable
Debianpodman136.1.1+ds1-1vulnerable
Debianpodman145.4.2+ds1-2vulnerable
Debianpodman145.6.1+ds1-1vulnerable
Debianpodman145.6.1+ds1-2vulnerable
Debianpodman145.6.1+ds2-2vulnerable
Debianpodman145.6.1+ds2-3vulnerable
Debianpodman145.6.2+ds1-1vulnerable
Debianpodman145.6.2+ds1-2vulnerable
Debianpodman145.6.2+ds1-3vulnerable
Debianpodman145.6.2+ds1-3+exp1vulnerable
Debianpodman145.6.2+ds1-4vulnerable
Debianpodman145.7.0+ds2-1vulnerable
Debianpodman145.7.0+ds2-2vulnerable
Debianpodman145.7.0+ds2-3vulnerable
Debianpodman145.8.0+ds1-1vulnerable
Debianpodman145.8.1+ds1-1vulnerable
Debianpodman145.8.1+ds1-2vulnerable
Debianpodman145.8.1+ds1-3vulnerable
Debianpodman145.8.2+ds1-1vulnerable
Debianpodman145.8.2+ds1-2vulnerable
Debianpodman145.8.2+ds1-3vulnerable
Debianpodman145.8.3+ds1-1vulnerable
Debianpodman145.8.4+ds1-1fixed
Opensusepodmantumbleweed6.0.2-1.1fixed
CpepodmanNot reportedNot reportedunknown

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
CpepodmancpeNot reported5.8.4Not reportedNot reportedNot reported
Gogithub.com/containers/podman/v5goNot reported5.8.4Not reportedGHSA-4HQ8-GPF5-8P68Not reported
Gogo.podman.io/podman/v6goNot reported6.0.0Not reportedGHSA-4HQ8-GPF5-8P68Not reported
Debianpodmandeb145.8.4+ds1-1Not reportedDEBIAN-CVE-2026-57231Not reported
Opensusepodmanrpmtumbleweed6.0.2-1.1Not reportedOPENSUSE-SU-2026:11437-1Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [podman]Affected

    Source package: [podman]

    Details (2)

    • 5.4.2+ds1-2+b2 · amd64 · trixie

      Affected

      nvd · podman · debian · 13

    • 5.4.2+ds1-2+b2 · arm64 · trixie

      Affected

      nvd · podman · debian · 13

  • [podman-docker]Affected

    Source package: [podman]

    Details (2)

    • 5.4.2+ds1-2+b2 · amd64 · trixie

      Affected

      nvd · podman · debian · 13

    • 5.4.2+ds1-2+b2 · arm64 · trixie

      Affected

      nvd · podman · debian · 13

  • [podman-remote]Affected

    Source package: [podman]

    Details (2)

    • 5.4.2+ds1-2+b2 · amd64 · trixie

      Affected

      nvd · podman · debian · 13

    • 5.4.2+ds1-2+b2 · arm64 · trixie

      Affected

      nvd · podman · debian · 13

[openSUSE Tumbleweed]

  • [podman-docker]Unknown

    Source package: [podman]

    Details (1)

    • 6.0.2-1.1 · noarch · tumbleweed

      Unknown · Fixed: 6.0.2-1.1

      Version impact unknown

      nvd · podman · opensuse · tumbleweed

  • [podman-remote]Unknown

    Source package: [podman]

    Details (1)

    • 6.0.2-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 6.0.2-1.1

      Version impact unknown

      nvd · podman · opensuse · tumbleweed

  • [podmansh]Unknown

    Source package: [podman]

    Details (1)

    • 6.0.2-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 6.0.2-1.1

      Version impact unknown

      nvd · podman · opensuse · tumbleweed

  • [podman]Fixed

    Source package: [podman]

    Details (1)

    • 6.0.2-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 6.0.2-1.1

      nvd · podman · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]