{"id":"CVE-2026-57231","title":"podman: Podman: Information disclosure via malicious container image environment variables (CVE-2026-57231)","summary":"A flaw was found in Podman, a tool for managing OCI containers and pods. A malicious container image can be crafted with an environment variable that has a key but no value, or an asterisk (*), to trick Podman. This vulnerability causes Po…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"vendor","cwe":["CWE-914","CWE-200"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream (v. 8)","affected":["enterprise_linux 8","openshift_container_platform 4","openstack_platform 18.0","openshift_container_platform 4.22","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_8","enterprise_linux_appstream_v_9","enterprise_linux_codeready_linux_builder_v_10","hardened_images","quay 3.10","quay 3.12","quay 3.14","quay 3.15","quay 3.16","quay 3.17","quay 3.9"],"patched":["openshift_container_platform 4.22","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_8","enterprise_linux_appstream_v_9","enterprise_linux_codeready_linux_builder_v_10","hardened_images","quay 3.10","quay 3.12","quay 3.14","quay 3.15","quay 3.16","quay 3.17","quay 3.9"],"published":"2026-06-26","updated":"2026-10-02","sourceUpdated":"2026-10-02T17:03:05+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57231.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57231.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-57231"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493620"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-57231"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57231"},{"url":"https://github.com/podman-container-tools/podman/commit/6c431b73dbf8e4b20b778644d7a80caebdb75050"},{"url":"https://github.com/podman-container-tools/podman/security/advisories/GHSA-4hq8-gpf5-8p68"},{"url":"https://access.redhat.com/errata/RHSA-2026:44232"},{"url":"https://access.redhat.com/errata/RHSA-2026:37072"},{"url":"https://access.redhat.com/errata/RHSA-2026:38504"},{"url":"https://access.redhat.com/errata/RHSA-2026:37123"},{"url":"https://access.redhat.com/errata/RHSA-2026:29954"},{"url":"https://access.redhat.com/errata/RHSA-2026:53520"},{"url":"https://access.redhat.com/errata/RHSA-2026:52968"},{"url":"https://access.redhat.com/errata/RHSA-2026:70267"},{"url":"https://access.redhat.com/errata/RHSA-2026:63307"},{"url":"https://access.redhat.com/errata/RHSA-2026:69255"},{"url":"https://access.redhat.com/errata/RHSA-2026:54395"},{"url":"https://access.redhat.com/errata/RHSA-2026:50931"},{"url":"https://github.com/podman-container-tools/podman"},{"url":"https://github.com/podman-container-tools/podman/releases/tag/v5.8.4"},{"url":"https://github.com/podman-container-tools/podman/releases/tag/v6.0.0"},{"url":"https://github.com/advisories/GHSA-4hq8-gpf5-8p68"}],"tags":["csaf","vex","red-hat","osv","go","ghsa"],"epss":0.00437,"epssPercentile":0.37776,"aliases":["GHSA-4hq8-gpf5-8p68","GO-2026-6594"],"ecosystem":"go","ingestedAt":"2026-09-24T19:50:30.720Z","slug":"CVE-2026-57231","body":"## Overview\n\nA flaw was found in Podman, a tool for managing OCI containers and pods. A malicious container image can be crafted with an environment variable that has a key but no value, or an asterisk (*), to trick Podman. This vulnerability causes Podman to pass host environment variables into the container. Consequently, a malicious image could exfiltrate all Podman environment variables set in the session from which the container is launched, leading to information disclosure.\n\n## Vendor advisories\n\n- **RHSA-2026:44232** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-07-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:44232)\n- **RHSA-2026:37072** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:37072)\n- **RHSA-2026:38504** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-07-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:38504)\n- **RHSA-2026:37123** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:37123)\n- **RHSA-2026:29954** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:29954)\n- **RHSA-2026:53520** · Red Hat · fixed in: Red Hat Quay 3.10 · released 2026-08-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:53520)\n- **RHSA-2026:52968** · Red Hat · fixed in: Red Hat Quay 3.12 · released 2026-08-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:52968)\n- **RHSA-2026:70267** · Red Hat · fixed in: Red Hat Quay 3.14 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:70267)\n- **RHSA-2026:63307** · Red Hat · fixed in: Red Hat Quay 3.15 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63307)\n- **RHSA-2026:69255** · Red Hat · fixed in: Red Hat Quay 3.16 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69255)\n- **RHSA-2026:54395** · Red Hat · fixed in: Red Hat Quay 3.17 · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54395)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4, Red Hat OpenStack Platform 18.0 · no fix planned: Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4, Red Hat OpenStack Platform 18.0 · updated 2026-10-02 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57231.json)\n- **RHSA-2026:50931** · Red Hat · fixed in: Red Hat Quay 3.9 · released 2026-08-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:50931)\n\n**podman: Podman: Information disclosure via malicious container image environment variables** — rated Important by Red Hat. Released 2026-06-26, updated 2026-10-02.\n\nAffected:\n\n- Red Hat Enterprise Linux 8\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenStack Platform 18.0\n\nFixed:\n\n- Red Hat OpenShift Container Platform 4.22\n- Red Hat Enterprise Linux AppStream (v. 10)\n- Red Hat Enterprise Linux AppStream (v. 8)\n- Red Hat Enterprise Linux AppStream (v. 9)\n- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)\n- Red Hat Hardened Images\n- Red Hat Quay 3.10\n- Red Hat Quay 3.12\n- Red Hat Quay 3.14\n- Red Hat Quay 3.15\n- Red Hat Quay 3.16\n- Red Hat Quay 3.17\n- Red Hat Quay 3.9\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 8\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenStack Platform 18.0\n\nNot affected:\n\n- Red Hat Quay 3.10\n- Red Hat Quay 3.12\n- Red Hat Quay 3.14\n- Red Hat Quay 3.15\n- Red Hat Quay 3.16\n- Red Hat Quay 3.17\n- Red Hat Quay 3.9\n- Red Hat Ansible Automation Platform 2\n- Red Hat Developer Hub\n- Red Hat Enterprise Linux 10\n\n## Remediation\n\nFor OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as fol… https://access.redhat.com/errata/RHSA-2026:44232\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:37072\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:38504\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\n## Package advisory (CVE-2026-57231)\n\nAffected packages:\n\n- `github.com/containers/podman/v5 < 5.8.4`\n- `go.podman.io/podman/v6 < 6.0.0`\n- `github.com/containers/podman/v4 <= 4.9.5`\n- `github.com/containers/podman/v3 <= 3.4.7`\n- `github.com/containers/podman/v2 <= 2.2.1`\n- `github.com/containers/podman >= 1.8.1`\n\nPatched in:\n\n- `github.com/containers/podman/v5 5.8.4`\n- `go.podman.io/podman/v6 6.0.0`\n\nSource: https://osv.dev/vulnerability/GHSA-4hq8-gpf5-8p68","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}