--- id: CVE-2026-57231 title: >- podman: Podman: Information disclosure via malicious container image environment variables (CVE-2026-57231) summary: >- A flaw was found in Podman, a tool for managing OCI containers and pods. A malicious container image can be crafted with an environment variable that has a key but no value, or an asterisk (*), to trick Podman. This vulnerability causes Po… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N' cvssSource: vendor cwe: - CWE-914 - CWE-200 vendor: Red Hat product: Red Hat Enterprise Linux AppStream (v. 8) affected: - enterprise_linux 8 - openshift_container_platform 4 - openstack_platform 18.0 - openshift_container_platform 4.22 - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_v_8 - enterprise_linux_appstream_v_9 - enterprise_linux_codeready_linux_builder_v_10 - hardened_images - quay 3.10 - quay 3.12 - quay 3.14 - quay 3.15 - quay 3.16 - quay 3.17 - quay 3.9 patched: - openshift_container_platform 4.22 - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_v_8 - enterprise_linux_appstream_v_9 - enterprise_linux_codeready_linux_builder_v_10 - hardened_images - quay 3.10 - quay 3.12 - quay 3.14 - quay 3.15 - quay 3.16 - quay 3.17 - quay 3.9 published: '2026-06-26' updated: '2026-10-02' sourceUpdated: '2026-10-02T17:03:05+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57231.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57231.json - url: 'https://access.redhat.com/security/cve/CVE-2026-57231' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2493620' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-57231' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-57231' - url: >- https://github.com/podman-container-tools/podman/commit/6c431b73dbf8e4b20b778644d7a80caebdb75050 - url: >- https://github.com/podman-container-tools/podman/security/advisories/GHSA-4hq8-gpf5-8p68 - url: 'https://access.redhat.com/errata/RHSA-2026:44232' - url: 'https://access.redhat.com/errata/RHSA-2026:37072' - url: 'https://access.redhat.com/errata/RHSA-2026:38504' - url: 'https://access.redhat.com/errata/RHSA-2026:37123' - url: 'https://access.redhat.com/errata/RHSA-2026:29954' - url: 'https://access.redhat.com/errata/RHSA-2026:53520' - url: 'https://access.redhat.com/errata/RHSA-2026:52968' - url: 'https://access.redhat.com/errata/RHSA-2026:70267' - url: 'https://access.redhat.com/errata/RHSA-2026:63307' - url: 'https://access.redhat.com/errata/RHSA-2026:69255' - url: 'https://access.redhat.com/errata/RHSA-2026:54395' - url: 'https://access.redhat.com/errata/RHSA-2026:50931' - url: 'https://github.com/podman-container-tools/podman' - url: 'https://github.com/podman-container-tools/podman/releases/tag/v5.8.4' - url: 'https://github.com/podman-container-tools/podman/releases/tag/v6.0.0' - url: 'https://github.com/advisories/GHSA-4hq8-gpf5-8p68' tags: - csaf - vex - red-hat - osv - go - ghsa epss: 0.00437 epssPercentile: 0.37776 aliases: - GHSA-4hq8-gpf5-8p68 - GO-2026-6594 ecosystem: go ingestedAt: '2026-09-24T19:50:30.720Z' --- ## Overview A flaw was found in Podman, a tool for managing OCI containers and pods. A malicious container image can be crafted with an environment variable that has a key but no value, or an asterisk (*), to trick Podman. This vulnerability causes Podman to pass host environment variables into the container. Consequently, a malicious image could exfiltrate all Podman environment variables set in the session from which the container is launched, leading to information disclosure. ## Vendor advisories - **RHSA-2026:44232** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-07-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:44232) - **RHSA-2026:37072** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:37072) - **RHSA-2026:38504** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-07-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:38504) - **RHSA-2026:37123** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:37123) - **RHSA-2026:29954** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:29954) - **RHSA-2026:53520** · Red Hat · fixed in: Red Hat Quay 3.10 · released 2026-08-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:53520) - **RHSA-2026:52968** · Red Hat · fixed in: Red Hat Quay 3.12 · released 2026-08-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:52968) - **RHSA-2026:70267** · Red Hat · fixed in: Red Hat Quay 3.14 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:70267) - **RHSA-2026:63307** · Red Hat · fixed in: Red Hat Quay 3.15 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63307) - **RHSA-2026:69255** · Red Hat · fixed in: Red Hat Quay 3.16 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69255) - **RHSA-2026:54395** · Red Hat · fixed in: Red Hat Quay 3.17 · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54395) - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4, Red Hat OpenStack Platform 18.0 · no fix planned: Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4, Red Hat OpenStack Platform 18.0 · updated 2026-10-02 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57231.json) - **RHSA-2026:50931** · Red Hat · fixed in: Red Hat Quay 3.9 · released 2026-08-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:50931) **podman: Podman: Information disclosure via malicious container image environment variables** — rated Important by Red Hat. Released 2026-06-26, updated 2026-10-02. Affected: - Red Hat Enterprise Linux 8 - Red Hat OpenShift Container Platform 4 - Red Hat OpenStack Platform 18.0 Fixed: - Red Hat OpenShift Container Platform 4.22 - Red Hat Enterprise Linux AppStream (v. 10) - Red Hat Enterprise Linux AppStream (v. 8) - Red Hat Enterprise Linux AppStream (v. 9) - Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) - Red Hat Hardened Images - Red Hat Quay 3.10 - Red Hat Quay 3.12 - Red Hat Quay 3.14 - Red Hat Quay 3.15 - Red Hat Quay 3.16 - Red Hat Quay 3.17 - Red Hat Quay 3.9 No fix planned: - Red Hat Enterprise Linux 8 - Red Hat OpenShift Container Platform 4 - Red Hat OpenStack Platform 18.0 Not affected: - Red Hat Quay 3.10 - Red Hat Quay 3.12 - Red Hat Quay 3.14 - Red Hat Quay 3.15 - Red Hat Quay 3.16 - Red Hat Quay 3.17 - Red Hat Quay 3.9 - Red Hat Ansible Automation Platform 2 - Red Hat Developer Hub - Red Hat Enterprise Linux 10 ## Remediation For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as fol… https://access.redhat.com/errata/RHSA-2026:44232 For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:37072 For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:38504 Workarounds / mitigations: - Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. ## Package advisory (CVE-2026-57231) Affected packages: - `github.com/containers/podman/v5 < 5.8.4` - `go.podman.io/podman/v6 < 6.0.0` - `github.com/containers/podman/v4 <= 4.9.5` - `github.com/containers/podman/v3 <= 3.4.7` - `github.com/containers/podman/v2 <= 2.2.1` - `github.com/containers/podman >= 1.8.1` Patched in: - `github.com/containers/podman/v5 5.8.4` - `go.podman.io/podman/v6 6.0.0` Source: https://osv.dev/vulnerability/GHSA-4hq8-gpf5-8p68