Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-26T16:29:02 podman: Podman: Information disclosure via malicious container image environment variables 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-914

Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk (*) will cause podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all podman environment variables that are set in the session from where the container is launched. This vulnerability is fixed in 5.8.4 and 6.0.0.

A flaw was found in Podman, a tool for managing OCI containers and pods. A malicious container image can be crafted with an environment variable that has a key but no value, or an asterisk (*), to trick Podman. This vulnerability causes Podman to pass host environment variables into the container. Consequently, a malicious image could exfiltrate all Podman environment variables set in the session from which the container is launched, leading to information disclosure.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Enterprise Linux 10 2026-07-09T00:00:00Z RHSA-2026:37072 podman-7:5.8.2-4.el10_2 Red Hat Enterprise Linux 8 2026-07-13T00:00:00Z RHSA-2026:38504 container-tools:rhel8-8100020260709093628.afee755d Red Hat Enterprise Linux 9 2026-07-09T00:00:00Z RHSA-2026:37123 podman-6:5.8.2-4.el9_8 Red Hat Hardened Images 2026-06-25T00:00:00Z RHSA-2026:29954 podman-main-6.0.0-1.hum1 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-26/eda-controller-rhel9 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-27/eda-controller-rhel9 Red Hat Enterprise Linux 10 Not affected conmon Red Hat Enterprise Linux 8 Not affected conmon Red Hat Enterprise Linux 8 Affected podman Red Hat Enterprise Linux 9 Not affected conmon Red Hat OpenShift Container Platform 4 Not affected conmon Red Hat OpenShift Container Platform 4 Affected cri-o Red Hat OpenShift Container Platform 4 Affected kata-containers Red Hat OpenShift Container Platform 4 Affected podman Red Hat OpenShift Container Platform 4 Affected rhcos Red Hat OpenShift Dev Spaces Affected devspaces/udi-base-rhel10 Red Hat OpenShift Virtualization 4 Affected container-native-virtualization/ocp-virt-validation-checkup-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso-operators/prometheus-podman-exporter-rhel9 Red Hat Quay 3 Affected quay/quay-builder-rhel8 Red Hat Quay 3 Affected quay/quay-builder-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-57231 https://nvd.nist.gov/vuln/detail/CVE-2026-57231 https://github.com/podman-container-tools/podman/commit/6c431b73dbf8e4b20b778644d7a80caebdb75050 https://github.com/podman-container-tools/podman/security/advisories/GHSA-4hq8-gpf5-8p68