cveboard RSS feed

CVE-2026-94603

GitHubCritical, go

Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation

Podman v4.4.0 added a feature where container checkpoints (from the podman container checkpoint command) could be distributed via OCI registry, and pulled from that registry and run via the podman run command. This allowed easy transfer of checkpoints between systems. However, checkpoints allow complete control of how the container is created - including full control of the container sandbox.

No known exploitation
Severity
Critical, CVSS 10.0 (v3.1)
EPSS
0.92% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
Affected packages