Skip to main content

Podman CVE-2026-57231

| EUVDEUVD-2026-39807 HIGH
Information Exposure (CWE-200)
2026-06-26 GitHub_M
Information Disclosure Red Hat Podman
7.5
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
6.5 MEDIUM

Exploitation requires the victim to run an attacker-supplied image (UI:R); no privileges needed (PR:N), high confidentiality loss of session secrets, no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

3
Patch available
Jun 26, 2026 - 18:02 EUVD
Source Code Evidence Fetched
Jun 26, 2026 - 17:22 vuln.today
Analysis Generated
Jun 26, 2026 - 17:22 vuln.today

DescriptionCVE.org

Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk (*) will cause podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all podman environment variables that are set in the session from where the container is launched. This vulnerability is fixed in 5.8.4 and 6.0.0.

AnalysisAI

Information disclosure in Podman (1.8.1 through 5.8.3) lets a malicious OCI container image leak host environment variables into the container by embedding an image env entry with a key but no value; an asterisk (*) entry causes Podman to forward ALL host session variables. Because the launching session frequently holds secrets (registry credentials, API tokens, proxy auth), a crafted image run by a victim can harvest them. No public exploit is identified beyond the proof-of-concept test shipped with the fix, and it is not listed in CISA KEV.

Technical ContextAI

Podman builds a container's environment by parsing the image config's Env array (inspectData.Config.Env). The flawed code used envLib.ParseSlice / a naive strings.Cut without validating that each entry contained an '=' and a non-empty key. A bare key like 'HOST' (no value) or '*' was mishandled so that Podman resolved the value from the host's own environment, effectively importing host variables into the container. This is a CWE-200 (Exposure of Sensitive Information) issue rooted in trusting attacker-controlled image metadata. The fix (commit 6c431b73) adds ParseImageEnvs(), which rejects any entry where hasValue is false or key is empty, returning 'invalid image env variable', and applies the same validation to the Kubernetes/play-kube path (kube.go).

RemediationAI

Vendor-released patch: upgrade Podman to 5.8.4 (5.x branch) or 6.0.0, which add ParseImageEnvs() validation that rejects image env entries lacking an '=' or with an empty key. See advisory GHSA-4hq8-gpf5-8p68 and commit 6c431b73dbf8e4b20b778644d7a80caebdb75050. Until patched, the most effective compensating control is to only run images from trusted sources and to inspect untrusted images first with 'podman image inspect <image> --format {{.Config.Env}}' to spot suspicious bare-key or '*' env entries before running them. As a strong mitigation, avoid placing secrets in the shell environment of the session that launches containers (use --secret, secret files, or explicit env files), so that even a leaking image obtains nothing sensitive; the trade-off is workflow changes for tooling that relies on inherited environment. Restrict who can run arbitrary images on shared hosts.

Same weakness CWE-200 – Information Exposure

View all
CVE-2024-24919 HIGH POC
8.6
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8
CVE-2020-3259 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected
SUSE Linux Enterprise Module for Containers 15 SP7 Affected

Share

CVE-2026-57231 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy