Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-26T16:30:41 github.com/containers/podman: Podman: Host filesystem modification via malicious container image WORKDIR symlink 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N CWE-59

Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path contains a symlink can create a directory or modify ownership on the host filesystem. Modified ownership is less likely to happen as that requires help from an untrusted/malicious process that mutates the host filesystem tree during dereferencing of the WORKDIR path, to trigger a race condition. This vulnerability is fixed in 5.7.1.

A flaw was found in Podman. A remote attacker can exploit this vulnerability by running a malicious container image where the WORKDIR (working directory) path contains a symbolic link (symlink). This can lead to the creation of a directory or modification of ownership on the host filesystem, potentially impacting system integrity.

A flaw was found in Podman where running a malicious container image with a WORKDIR path containing a symlink can create directories or modify ownership on the host filesystem. Exploitation requires the user to pull and run a specifically crafted malicious container image. Red Hat rates this as Moderate impact, consistent with the upstream assessment, because the attack requires a malicious image and the most severe outcome (ownership modification) requires additional help from an underprivileged user namespace. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Hardened Images 2026-06-25T00:00:00Z RHSA-2026:29954 podman-main-6.0.0-1.hum1 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/eda-controller-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/eda-controller-rhel9 Red Hat Enterprise Linux 10 Fix deferred podman Red Hat Enterprise Linux 8 Fix deferred container-tools:rhel8/podman Red Hat Enterprise Linux 9 Fix deferred podman Red Hat OpenShift Container Platform 4 Fix deferred podman Red Hat OpenShift Container Platform 4 Fix deferred rhcos Red Hat OpenShift Virtualization 4 Fix deferred container-native-virtualization/ocp-virt-validation-checkup-rhel9 Red Hat Quay 3 Fix deferred quay/quay-builder-rhel8 Red Hat Quay 3 Fix deferred quay/quay-builder-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-55686 https://nvd.nist.gov/vuln/detail/CVE-2026-55686 https://github.com/podman-container-tools/podman/commit/d18e44e9abb3bf5b7294aa70806e1368fdddfdd0 https://github.com/podman-container-tools/podman/security/advisories/GHSA-q6r4-3wmg-fwcq