10

CVE-2026-94603: podman-container-tools podman Protection Mechanism Failure

CVSS: 10.0v3.1CriticalAwaiting analysis
AliasesRHSA-2026:74178UBUNTU-CVE-2026-94603DEBIAN-CVE-2026-94603
Published 13-10-2026Last modified 13-10-2026
Open JSON

Vulnerability summary

CVE-2026-94603 is a critical (CVSS 10.0) Protection Mechanism Failure vulnerability in podman-container-tools podman. EPSS estimates a 0.92% chance of exploitation in the next 30 days, higher than 59.6% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
10.0/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.92%
0%100%
Low · Change unavailable
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1
RHSA-2026:74861

Timeline

  1. 13-10-2026
    PublishedVulnerability first disclosed.
  2. 13-10-2026
    Last modifiedVulnerability information updated.

Description

Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3.

CVSS metrics

8 scores · 8 sources · 1 version

EPSS trend

Probability

0.92%

Chance of exploitation in the next 30 days

Percentile

60%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

14-10-202620-10-2026
EPSS score
0.92%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard5 products
  • falco-no-driverAll versions (No fix recorded) | < 0.45.0-r9
  • podman-6.0All versions (No fix recorded)
  • podman-fips-6.0All versions (No fix recorded)
  • prometheus-podman-exporterAll versions (No fix recorded) | < 2.0.0-r6
  • prometheus-podman-exporter-fipsAll versions (No fix recorded) | < 2.0.0-r6
Redhat5 products
  • podman< 0:6.1.2-1.1.hum1
  • podman-docker< 0:6.1.2-1.1.hum1
  • podman-machine< 0:6.1.2-1.1.hum1
  • podman-remote< 0:6.1.2-1.1.hum1
  • podmansh< 0:6.1.2-1.1.hum1
Github.com/containers/podman4 products
  • v2All versions (No fix recorded)
  • v3All versions (No fix recorded)
  • v4≥ 4.4.0 (No fix recorded)
  • v5< 5.8.8
Wolfi2 products
  • falco-no-driverAll versions (No fix recorded) | < 0.45.0-r9
  • podman-6.0All versions (No fix recorded)
Debian1 product
  • podmanAll versions (No fix recorded) | < 5.8.6+ds1-3
Github.com/containers1 product
  • podman≥ 4.4.0, < 5.8.8 | All versions (No fix recorded)
Go.podman.io/podman1 product
  • v6≥ 6.0.0, < 6.1.3
Podman-container-tools1 product
  • podman≥ 4.4.0, < 5.8.8 | ≥ 6.0.0, < 6.1.3
Ubuntu1 product
  • podmanAll versions (No fix recorded)

9 vendors · 21 products

References

21 links
Show all 21 references