Suggestions search

Untriaged

Filter by:

With package: podman-desktop

Found 2 matching suggestions

View:

Compact

Detailed

Permalink CVE-2026-55686

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

created 2 weeks, 4 days ago Activity log

Created suggestion 2 weeks, 4 days ago

Podman: WORKDIR symlink traversal vulnerability

Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path contains a symlink can create a directory or modify ownership on the host filesystem. Modified ownership is less likely to happen as that requires help from an untrusted/malicious process that mutates the host filesystem tree during dereferencing of the WORKDIR path, to trigger a race condition. This vulnerability is fixed in 5.7.1.

References

https://github.com/podman-container-tools/podman/security/advisories/GHSA-q6r4-3wmg-fwcq x_refsource_CONFIRMexploit
https://github.com/podman-container-tools/podman/commit/d18e44e9abb3bf5b7294aa70806e1368fdddfdd0 x_refsource_MISC

Affected products

podman

==>= 3.0.0, < 5.7.1

Matching in nixpkgs

pkgs.podman

Program for managing pods, containers and container images

nixos-unstable 5.8.2
- nixpkgs-unstable 5.8.2
- nixos-unstable-small 5.8.2
nixos-26.05 5.8.2
- nixos-26.05-small 5.8.2
- nixpkgs-26.05-darwin 5.8.2

pkgs.podman-tui

Podman Terminal UI

nixos-unstable 1.11.1
- nixpkgs-unstable 1.11.1
- nixos-unstable-small 1.11.1
nixos-26.05 1.11.1
- nixos-26.05-small 1.11.1
- nixpkgs-26.05-darwin 1.11.1

pkgs.podman-bootc

Streamlining podman+bootc interactions

nixos-unstable 0.1.2
- nixpkgs-unstable 0.1.2
- nixos-unstable-small 0.1.2
nixos-26.05 0.1.2
- nixos-26.05-small 0.1.2
- nixpkgs-26.05-darwin 0.1.2

pkgs.cockpit-podman

Cockpit UI for podman containers

nixos-unstable 127
- nixpkgs-unstable 125
- nixos-unstable-small 127
nixos-26.05 125
- nixos-26.05-small 125
- nixpkgs-26.05-darwin 125

pkgs.podman-compose

Implementation of docker-compose with podman backend

nixos-unstable 1.5.0
- nixpkgs-unstable 1.5.0
- nixos-unstable-small 1.5.0
nixos-26.05 1.5.0
- nixos-26.05-small 1.5.0
- nixpkgs-26.05-darwin 1.5.0

pkgs.podman-desktop

Graphical tool for developing on containers and Kubernetes

nixos-unstable 1.27.2
- nixpkgs-unstable 1.26.2
- nixos-unstable-small 1.27.2
nixos-26.05 1.26.2
- nixos-26.05-small 1.26.2
- nixpkgs-26.05-darwin 1.26.2

pkgs.nomad-driver-podman

Podman task driver for Nomad

nixos-unstable 0.6.4
- nixpkgs-unstable 0.6.4
- nixos-unstable-small 0.6.4
nixos-26.05 0.6.4
- nixos-26.05-small 0.6.4
- nixpkgs-26.05-darwin 0.6.4

pkgs.python312Packages.podman

None

pkgs.python313Packages.podman

Python bindings for Podman's RESTful API

nixos-unstable 5.8.0
- nixpkgs-unstable 5.8.0
- nixos-unstable-small 5.8.0
nixos-26.05 5.8.0
- nixos-26.05-small 5.8.0
- nixpkgs-26.05-darwin 5.8.0

pkgs.python314Packages.podman

Python bindings for Podman's RESTful API

nixos-unstable 5.8.0
- nixpkgs-unstable 5.8.0
- nixos-unstable-small 5.8.0
nixos-26.05 5.8.0
- nixos-26.05-small 5.8.0
- nixpkgs-26.05-darwin 5.8.0

Package maintainers

@cpcloud Phillip Cloud
@saschagrunert Sascha Grunert <mail@saschagrunert.de>
@vdemeester Vincent Demeester <vincent@sbr.pm>
@evan-goode Evan Goode <mail@evangoo.de>
@sikmir Nikolay Korotkiy <sikmir@disroot.org>
@booxter Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
@aaronjheng Aaron Jheng <wentworth@outlook.com>
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
@andre4ik3 andre4ik3 <andre4ik3@fastmail.com>
@alexandru0-dev Alexandru Nechita <alexandru.italia32+nixpkgs@gmail.com>
@lucasew Lucas Eduardo Wendt <lucas59356@gmail.com>

Permalink CVE-2026-57231

7.5 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 2 weeks, 4 days ago Activity log

Created suggestion 2 weeks, 4 days ago

Podman: Malformed Image can trick podman run into leaking host environment variables into the container

Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk (*) will cause podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all podman environment variables that are set in the session from where the container is launched. This vulnerability is fixed in 5.8.4 and 6.0.0.