CVE-2026-79699

Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory

4.4 MediumFix available

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: Low

Exploit likelihood

0.17%Unchanged since Sep 16, 2026

What each source reports

CVE List Score used4.4

Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory

Record: CVE-2026-79699
CVSS 3.1: 4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Weakness: CWE-59
Updated: 2026-11-06

EUVDEUVD-2026-788244.4

Record: EUVD-2026-78824
CVSS 3.1: 4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Updated: 2026-11-06

GitHub AdvisoriesGHSA-p44w-25fh-fx4c4.4

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious...

Record: GHSA-p44w-25fh-fx4c
CVSS 3.1: 4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Weakness: CWE-59
Updated: 2026-11-02

NVD4.4

Record: CVE-2026-79699
CVSS 3.1: 4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Weakness: CWE-59
Updated: 2026-11-06

OSVALPINE-CVE-2026-796994.4

Record: ALPINE-CVE-2026-79699
CVSS 3.1: 4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Updated: 2026-11-03

OSVBELL-CVE-2026-796994.4

Record: BELL-CVE-2026-79699
CVSS 3.1: 4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Updated: 2026-11-02

Show 12 moreShow less

OSVDEBIAN-CVE-2026-796994.4

Record: DEBIAN-CVE-2026-79699
CVSS 3.1: 4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Updated: 2026-11-07

OSVUBUNTU-CVE-2026-796994.4

Record: UBUNTU-CVE-2026-79699
CVSS 3.1: 4.4 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Updated: 2026-11-02

OSVAZL-103062No score

CVE-2026-79699 affecting package buildah 1.43.1-3

Record: AZL-103062
Updated: 2026-11-05

OSVAZL-103071No score

CVE-2026-79699 affecting package cri-o 1.30.1-1

Record: AZL-103071
Updated: 2026-11-05

OSVAZL-103089No score

CVE-2026-79699 affecting package podman 5.6.1-10

Record: AZL-103089
Updated: 2026-11-05

OSVAZL-103140No score

CVE-2026-79699 affecting package containerized-data-importer 1.62.0-9

Record: AZL-103140
Updated: 2026-11-05

OSVAZL-103227No score

CVE-2026-79699 affecting package libcontainers-common 20240213-3

Record: AZL-103227
Updated: 2026-11-02

OSVAZL-103269No score

CVE-2026-79699 affecting package skopeo 1.14.4-15

Record: AZL-103269
Updated: 2026-11-05

OSVAZL-108396No score

CVE-2026-79699 affecting package moby-engine 25.0.18-1

Record: AZL-108396
Updated: 2026-11-05

OSVopenSUSE-SU-2026:12068-1No score

podman-6.1.2-1.1 on GA media

These are all security issues fixed in the podman-6.1.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:12068-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:12478-1No score

skopeo-1.24.0-2.1 on GA media

These are all security issues fixed in the skopeo-1.24.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:12478-1
Updated: 2026-11-07

OSVSUSE-SU-2026:5193-1No score

Security update for skopeo

This update for skopeo fixes the following issues:

CVE-2026-34986: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262823).
CVE-2026-79699: crafted tar archive containing malicious whiteout header can cause the extraction destination directory to be replaced with an arbitrary file (bsc#1280698).
CVE-2026-116585,CVE-2026-116586,CVE-2026-116587: github.com/go-jose/go-jose/v4: multiple security issues in github.com/go-jose/go-jose before 4.1.6 (bsc#1288278).

Record: SUSE-SU-2026:5193-1
Updated: 2026-11-12

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`podman` Alpine:v3.24	before 5.8.8-r0	5.8.8-r0
`buildah` Azure Linux:3	through 1.43.1-3	None known
`cri-o` Azure Linux:3	through 1.30.1-1	None known
`podman` Azure Linux:3	through 5.6.1-10	None known
`containerized-data-importer` Azure Linux:3	through 1.62.0-9	None known
`libcontainers-common` Azure Linux:3	through 20240213-3	None known
`skopeo` Azure Linux:3	through 1.14.4-15	None known
`moby-engine` Azure Linux:3	through 25.0.18-1	None known
`podman` Alpaquita:stream	4.5.1-r1 up to 6.1.3-r0	6.1.3-r0
`golang-github-containers-storage` Debian:12	All versions, plus listed versions 1.43.0+ds1-81.44.0+ds1-11.45.1+ds1-11.45.1+ds1-21.46.1+ds1-1 Show 36 moreShow less 1.46.1+ds1-21.46.1+ds1-31.46.1+ds1-41.48.1+ds1-11.48.1+ds1-21.48.1+ds1-2~bpo12+11.50.2+ds1-11.50.2+ds1-21.51.0+ds1-11.51.0+ds1-21.52.0+ds1-11.53.0+ds1-11.53.0+ds1-21.55.0+ds1-11.55.0+ds1-21.55.0+ds1-31.55.1+ds1-11.56.0+ds1-11.56.0+ds1-21.56.1+ds1-11.57.1+ds1-11.57.2+ds1-11.59.1+ds1-11.59.1+ds1-21.59.1+ds1-31.61.0+ds1-11.61.0+ds1-21.61.0+ds1-31.61.0+ds1-41.61.0+ds1-51.61.0+ds1-61.62.0-11.62.0-21.62.0-31.63.0-11.64.0-1	None known

Show 21 moreShow less

Affected packages
Package	Affected	Fixed
`golang-github-containers-storage` Debian:13	All versions, plus listed versions 1.57.2+ds1-11.59.1+ds1-11.59.1+ds1-21.59.1+ds1-31.61.0+ds1-1 Show 10 moreShow less 1.61.0+ds1-21.61.0+ds1-31.61.0+ds1-41.61.0+ds1-51.61.0+ds1-61.62.0-11.62.0-21.62.0-31.63.0-11.64.0-1	None known
`golang-github-containers-storage` Debian:14	All versions, plus listed versions 1.57.2+ds1-11.59.1+ds1-11.59.1+ds1-21.59.1+ds1-31.61.0+ds1-1 Show 10 moreShow less 1.61.0+ds1-21.61.0+ds1-31.61.0+ds1-41.61.0+ds1-51.61.0+ds1-61.62.0-11.62.0-21.62.0-31.63.0-11.64.0-1	None known
`skopeo` SUSE:Linux Enterprise Micro 5.5 From an advisory covering 5 CVEs	before 1.14.4-150300.11.25.1	1.14.4-150300.11.25.1
`skopeo` SUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 5 CVEs	before 1.14.4-150300.11.25.1	1.14.4-150300.11.25.1
`skopeo` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 5 CVEs	before 1.14.4-150300.11.25.1	1.14.4-150300.11.25.1
`skopeo` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 5 CVEs	before 1.14.4-150300.11.25.1	1.14.4-150300.11.25.1
`skopeo` SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 5 CVEs	before 1.14.4-150300.11.25.1	1.14.4-150300.11.25.1
`skopeo` SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 5 CVEs	before 1.14.4-150300.11.25.1	1.14.4-150300.11.25.1
`skopeo` SUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 5 CVEs	before 1.14.4-150300.11.25.1	1.14.4-150300.11.25.1
`skopeo` SUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 5 CVEs	before 1.14.4-150300.11.25.1	1.14.4-150300.11.25.1
`skopeo` SUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 5 CVEs	before 1.14.4-150300.11.25.1	1.14.4-150300.11.25.1
`skopeo` SUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 5 CVEs	before 1.14.4-150300.11.25.1	1.14.4-150300.11.25.1
`skopeo` SUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 5 CVEs	before 1.14.4-150300.11.25.1	1.14.4-150300.11.25.1
`skopeo` SUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 5 CVEs	before 1.14.4-150300.11.25.1	1.14.4-150300.11.25.1
`golang-github-containers-storage` Ubuntu:20.04:LTS	All versions, plus listed versions 1.13.2+dfsg1-21.13.2+dfsg1-31.13.5+dfsg1-11.15.1+dfsg1-11.15.2+dfsg1-1 Show 7 moreShow less 1.15.3+dfsg1-11.15.5+dfsg1-11.15.7+dfsg1-11.15.8+dfsg1-11.15.8+dfsg1-1ubuntu11.15.8+dfsg1-1ubuntu21.15.8+dfsg1-1ubuntu2.1	None known
`golang-github-containers-storage` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 1.31.3+ds1-1ubuntu11.36.0+ds1-21.36.0+ds1-2ubuntu0.11.36.0+ds1-2ubuntu0.1+esm11.36.0+ds1-2ubuntu0.1+esm2	None known
`golang-github-containers-storage` Ubuntu:24.04:LTS	All versions, plus listed versions 1.43.0+ds1-8build11.50.2+ds1-21.51.0+ds1-21.51.0+ds1-2ubuntu0.24.04.11.51.0+ds1-2ubuntu0.24.04.21.51.0+ds1-2ubuntu0.24.04.3	None known
`golang-github-containers-storage` Ubuntu:26.10	All versions, plus listed versions 1.61.0+ds1-61.62.0-31.63.0-1	None known
`golang-github-containers-storage` Ubuntu:26.04:LTS	All versions, plus listed versions 1.57.2+ds1-11.61.0+ds1-6	None known
`podman` openSUSE:Tumbleweed From an advisory covering 3 CVEs	before 6.1.2-1.1	6.1.2-1.1
`skopeo` openSUSE:Tumbleweed From an advisory covering 4 CVEs	before 1.24.0-2.1	1.24.0-2.1

History

History
Recorded	Changed	Sources
Nov 12, 2026	affected, aliases, references	OSV
Nov 7, 2026	affected, aliases, references	CVE List, EUVD, NVD, OSV
Nov 6, 2026	affected
Nov 5, 2026	facts	OSV
Nov 3, 2026	affected, aliases, references	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-79699 is a medium vulnerability (CVSS 4.4) in Red Hat Ansible Automation Platform 2, published September 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. Fixed in podman 5.8.8-r0.

References

Show 14 moreShow less