DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-19730: CVE-2026-19730: Podman Quadlet Install Non-Truncating Write Retains Removed Host-Access/Security Directives

#security #cve #cybersecurity

CVE-2026-19730: Podman Quadlet Install Non-Truncating Write Retains Removed Host-Access/Security Directives

Vulnerability ID: CVE-2026-19730
CVSS Score: 4.2
Published: 2026-09-24

CVE-2026-19730 is a local security vulnerability in the Podman container engine's Quadlet systemd generator. When updating existing configurations using 'podman quadlet install --replace' on filesystems that do not support reflink operations (such as standard ext4), the file is opened without the O_TRUNC flag. If the new configuration file is shorter than the pre-existing file, the trailing lines of the old file remain intact and are successfully parsed by systemd, leading to a failure to remove security-critical parameters like AddCapability, User, or host storage mounts.

TL;DR

An oversight in Podman's configuration-overwriting mechanism fails to truncate files on standard filesystems. When an administrator attempts to reduce container privileges or remove volume mounts by installing a shorter configuration file, the old security-critical lines remain at the end of the file and are still parsed, causing the privileges to persist silently.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-459 (Incomplete Cleanup)
  • Attack Vector: Local (AV:L)
  • CVSS v3.1 Score: 4.2 (Medium)
  • EPSS Score: 0.00163 (Percentile: 4.85%)
  • Impact Type: Security Bypass / Privilege Persistence
  • Exploit Status: Proof-of-Concept Available
  • CISA KEV Status: Not Listed

Affected Systems

  • Red Hat Enterprise Linux 9 (podman package prior to 6:5.8.2-7.el9_8)
  • Red Hat Enterprise Linux 10 (podman package prior to 7:5.8.2-9.el10_2)
  • Upstream Podman installations using Quadlet features on ext4 filesystems
  • Podman: < 5.8.6 (Fixed in: 5.8.6)
  • Podman: >= 5.9.0, < 6.0.0 (Fixed in: 6.0.0)

Code Analysis

Commit: a38a9b7

quadlet install: fix replace by writing to temporary file first

--- a/pkg/domain/infra/abi/quadlet.go
+++ b/pkg/domain/infra/abi/quadlet.go
- file, err := os.OpenFile(finalPath, osFlags, 0o644)
+ destFile, err = os.CreateTemp(filepath.Dir(finalPath), ".quadlet-install-*")
Enter fullscreen mode Exit fullscreen mode

Commit: d4fe915

quadlet: cherry-pick safe replace using atomic file writes to 5.8 branch

--- a/pkg/domain/infra/abi/quadlet.go
+++ b/pkg/domain/infra/abi/quadlet.go
+ destFile, err = os.CreateTemp(filepath.Dir(finalPath), ".quadlet-install-*")
Enter fullscreen mode Exit fullscreen mode

Exploit Details

  • GitHub: Original bug report and reproduction workflow detailing the lack of truncation on ext4 systems.

Mitigation Strategies

  • Upgrade Podman to version 5.8.6, 6.0.0, or newer to obtain the atomic file creation fix.
  • Manually delete target Quadlet configuration files before running install commands rather than using --replace.
  • Adopt copy-on-write (reflink) supporting filesystems like Btrfs or modern XFS for host deployments.
  • Implement file integrity monitoring and validation scripts to scan systemd configuration directories for stale directives.

Remediation Steps:

  1. Identify all managed systems running vulnerable Podman versions (under 5.8.6 / 6.0.0).
  2. Run 'dnf update podman' or 'apt-get install --only-upgrade podman' depending on the underlying OS distribution to apply the patch.
  3. If packages are locked or delayed, modify deployment and configuration pipelines to remove target Quadlets before running replacement commands.
  4. Perform a system-wide systemd daemon reload ('systemctl daemon-reload') to ensure clean config files are reloaded.

References

Read the full report for CVE-2026-19730 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)