CVE-2026-94603

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-94603
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94603.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-94603
Aliases
Downstream
BELL (1)
DEBIAN (1)
RHSA (2)
UBUNTU (1)
Published
2026-10-13T16:51:38Z
Modified
2026-10-15T02:47:34Z
Severity
  • 10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
Details

Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-693"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94603.json"
}
References

Affected packages

Git / github.com/podman-container-tools/podman

Affected ranges

Type
GIT
Repo
https://github.com/podman-container-tools/podman
Events
Introduced
3443f453e28169a88848f90a7ce3137fc4a4bebf
Introduced
a8ed4b6dd12992decf659cadfdfb3d0cb1937748
Fixed
ee099ca84b6c99376cefa765c84bf2082628e336
Fixed
85b994955e0b4e30fbce9c8351cab85676140ede
Fixed
24706290d5c974f078d8ca284026802515f28e92
Fixed
3721ff82ffb44a4ceeaecc5abd3808e924a6b669
Fixed
450c64426dbcff1097d3c7911d791101e3d16f4c
Fixed
7728ba0a90094408ad9078e36c3622a651d49616
Fixed
c74b1d37b3fb834b0de43e176565d9d8c254b627
Fixed
ea9243e04d1db3886dc3a51ee3300ffb547cfc02
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "4.4.0"
        },
        {
            "fixed":  "5.8.8"
        },
        {
            "introduced":  "6.0.0"
        },
        {
            "fixed":  "6.1.3"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94603.json"