---
id: CVE-2026-94603
title: Podman is a tool for managing OCI containers and pods
summary: >-
  Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8
  and 6.1.3, podman run treats an image carrying the
  io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and
  silently ignores user-supplied …
severity: critical
cvss: 10
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-693
  - CWE-15
vendor: Red Hat
product: Red Hat Hardened Images
affected:
  - ansible_automation_platform 2
  - build_of_podman_desktop
  - enterprise_linux 10
  - enterprise_linux 8
  - enterprise_linux 9
  - openshift_container_platform 4
  - openshift_dev_spaces
  - quay 3
  - hardened_images
  - quay 3.12
patched:
  - hardened_images
  - quay 3.12
published: '2026-10-13'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T16:00:33.533'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94603'
references:
  - url: >-
      https://github.com/podman-container-tools/podman/commit/24706290d5c974f078d8ca284026802515f28e92
    label: security-advisories@github.com
  - url: >-
      https://github.com/podman-container-tools/podman/commit/3721ff82ffb44a4ceeaecc5abd3808e924a6b669
    label: security-advisories@github.com
  - url: >-
      https://github.com/podman-container-tools/podman/commit/450c64426dbcff1097d3c7911d791101e3d16f4c
    label: security-advisories@github.com
  - url: >-
      https://github.com/podman-container-tools/podman/commit/7728ba0a90094408ad9078e36c3622a651d49616
    label: security-advisories@github.com
  - url: >-
      https://github.com/podman-container-tools/podman/commit/c74b1d37b3fb834b0de43e176565d9d8c254b627
    label: security-advisories@github.com
  - url: >-
      https://github.com/podman-container-tools/podman/commit/ea9243e04d1db3886dc3a51ee3300ffb547cfc02
    label: security-advisories@github.com
  - url: 'https://github.com/podman-container-tools/podman/releases/tag/v5.8.8'
    label: security-advisories@github.com
  - url: 'https://github.com/podman-container-tools/podman/releases/tag/v6.1.3'
    label: security-advisories@github.com
  - url: >-
      https://github.com/podman-container-tools/podman/security/advisories/GHSA-2cvf-wqm6-wr9g
    label: security-advisories@github.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94603.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-94603'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2542566'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-94603'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94603'
  - url: 'https://access.redhat.com/errata/RHSA-2026:74178'
  - url: 'https://access.redhat.com/errata/RHSA-2026:74861'
  - url: 'https://access.redhat.com/errata/RHSA-2026:79546'
  - url: 'https://github.com/advisories/GHSA-2cvf-wqm6-wr9g'
  - url: 'https://github.com/podman-container-tools/podman'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
  - ghsa
  - go
  - osv
epss: 0.00532
epssPercentile: 0.44759
aliases:
  - GHSA-2cvf-wqm6-wr9g
  - GO-2026-6770
ecosystem: go
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-13T20:19:31.021516Z'
scores:
  nvd: 10
  vendor: 8.6
  cna: 10
  ghsa: 10
  osv: 10
ingestedAt: '2026-10-13T17:38:53.202Z'
---

## Overview

Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-94603)

Affected packages:

- `github.com/containers/podman >= 4.4.0, < 5.8.8`
- `go.podman.io/podman/v6 >= 6.0.0, < 6.1.3`

Patched in:

- `github.com/containers/podman 5.8.8`
- `go.podman.io/podman/v6 6.1.3`

Source: https://github.com/advisories/GHSA-2cvf-wqm6-wr9g

## Vendor advisories

- **RHSA-2026:74178** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74178)
- **RHSA-2026:74861** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:74861)
- **RHSA-2026:79546** · Red Hat · fixed in: Red Hat Quay 3.12 · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:79546)
- **Red Hat VEX** · Important · affected: Red Hat Ansible Automation Platform 2, Red Hat Build of Podman Desktop, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4, … · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Build of Podman Desktop, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, … · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-94603.json)