DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-57231: CVE-2026-57231: Podman Malformed Image Host Environment Variable Leak

#security #cve #cybersecurity

CVE-2026-57231: Podman Malformed Image Host Environment Variable Leak

Vulnerability ID: CVE-2026-57231
CVSS Score: 7.5
Published: 2026-09-24

CVE-2026-57231 is a high-severity vulnerability in the Podman container engine. When executing a container from a crafted OCI or Docker image, malformed environment variable entries lacking an equals separator can trigger an unexpected behavior in the spec generation parser. This vulnerability enables a container image to silently exfiltrate host environment variables into the running container workspace, exposing high-privilege credentials and sensitive runtime secrets.

TL;DR

A design flaw in Podman's environment variable parser allows malicious container images containing malformed environment configurations to silently import and exfiltrate host shell environment variables, including wildcards, compromising sensitive credentials.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-200, CWE-668
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 7.5 (High)
  • EPSS Score: 0.00437
  • Impact: Confidentiality (High)
  • Exploit Status: poc
  • KEV Status: Not Listed

Affected Systems

  • Rocky Linux
  • Alma Linux
  • Alibaba Cloud Linux
  • Red Hat Enterprise Linux CoreOS (RHCOS)
  • Red Hat Enterprise Linux
  • openSUSE
  • Oracle Linux
  • Photon OS
  • podman: >= 1.8.1, < 5.8.4 (Fixed in: 5.8.4)
  • podman: >= 6.0.0-alpha, < 6.0.0 (Fixed in: 6.0.0)

Code Analysis

Commit: 6c431b7

pkg/specgen: validation check on image environment variables

Implement ParseImageEnvs validator using strings.Cut to reject keys lacking '=' and fix CompleteSpec and ToSpecGen.
Enter fullscreen mode Exit fullscreen mode

Exploit Details

Mitigation Strategies

  • Upgrade Podman to secure releases (5.8.4+ or 6.0.0+)
  • Enforce strict image pull policies to only permit verified, signed images from trusted internal registries
  • Sanitize shell sessions in sensitive CI/CD runners to prevent long-lived credentials from persisting in execution environments
  • Regularly audit local image storage for environment configurations lacking '=' characters

Remediation Steps:

  1. Identify all hosts running Podman versions >= 1.8.1 and < 5.8.4.
  2. Update Podman packages via the local package manager (e.g., 'dnf update podman' or 'apt-get install podman').
  3. Verify the installed version is 5.8.4, 6.0.0, or newer using 'podman --version'.
  4. Implement registry validation tools to detect images with invalid OCI config specifications.
  5. Inspect running environments for potential exposure using auditing commands.

References

Read the full report for CVE-2026-57231 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)