CriticalFix available
podman — security advisory
Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3.
- Products
- podman
- Affected versions
- 5.4.2+ds1-2, 5.6.1+ds1-1, 5.6.1+ds1-2, 5.6.1+ds2-2, 5.6.1+ds2-3, 5.6.2+ds1-1, 5.6.2+ds1-2, 5.6.2+ds1-3, 5.6.2+ds1-3+exp1, 5.6.2+ds1-4, 5.7.0+ds2-1, 5.7.0+ds2-2, 5.7.0+ds2-3, 5.8.0+ds1-1, 5.8.1+ds1-1, 5.8.1+ds1-2, 5.8.1+ds1-3, 5.8.2+ds1-1, 5.8.2+ds1-2, 5.8.2+ds1-3, 5.8.3+ds1-1, 5.8.4+ds1-1, 5.8.4+ds1-2, 5.8.6+ds1-1, 5.8.6+ds1-2, 5.8.6+ds1-3, 6.1.1+ds1-1
- Fixed versions
- 5.8.6+ds1-3
- CVEs
- CVE-2026-94603
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 22:30 UTC · Revision 1
Source evidence
Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3.
osv:DEBIAN-CVE-2026-94603
podman
Fixed versions: Not specified
podman
Fixed versions: 5.8.6+ds1-3
Complete source record
{
"id": "59076420dccb729309d4c9b73890052b8ff3182d381b4f91e58f00c59d302e1a",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-94603",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2026-94603",
"summary": "Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3.",
"evidence": "osv:DEBIAN-CVE-2026-94603",
"products": [
{
"name": {
"value": "podman",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.4.2+ds1-2",
"evidence": "/affected/0/versions"
},
{
"value": "5.6.1+ds1-1",
"evidence": "/affected/0/versions"
},
{
"value": "5.6.1+ds1-2",
"evidence": "/affected/0/versions"
},
{
"value": "5.6.1+ds2-2",
"evidence": "/affected/0/versions"
},
{
"value": "5.6.1+ds2-3",
"evidence": "/affected/0/versions"
},
{
"value": "5.6.2+ds1-1",
"evidence": "/affected/0/versions"
},
{
"value": "5.6.2+ds1-2",
"evidence": "/affected/0/versions"
},
{
"value": "5.6.2+ds1-3",
"evidence": "/affected/0/versions"
},
{
"value": "5.6.2+ds1-3+exp1",
"evidence": "/affected/0/versions"
},
{
"value": "5.6.2+ds1-4",
"evidence": "/affected/0/versions"
},
{
"value": "5.7.0+ds2-1",
"evidence": "/affected/0/versions"
},
{
"value": "5.7.0+ds2-2",
"evidence": "/affected/0/versions"
},
{
"value": "5.7.0+ds2-3",
"evidence": "/affected/0/versions"
},
{
"value": "5.8.0+ds1-1",
"evidence": "/affected/0/versions"
},
{
"value": "5.8.1+ds1-1",
"evidence": "/affected/0/versions"
},
{
"value": "5.8.1+ds1-2",
"evidence": "/affected/0/versions"
},
{
"value": "5.8.1+ds1-3",
"evidence": "/affected/0/versions"
},
{
"value": "5.8.2+ds1-1",
"evidence": "/affected/0/versions"
},
{
"value": "5.8.2+ds1-2",
"evidence": "/affected/0/versions"
},
{
"value": "5.8.2+ds1-3",
"evidence": "/affected/0/versions"
},
{
"value": "5.8.3+ds1-1",
"evidence": "/affected/0/versions"
},
{
"value": "5.8.4+ds1-1",
"evidence": "/affected/0/versions"
},
{
"value": "5.8.4+ds1-2",
"evidence": "/affected/0/versions"
},
{
"value": "5.8.6+ds1-1",
"evidence": "/affected/0/versions"
},
{
"value": "5.8.6+ds1-2",
"evidence": "/affected/0/versions"
},
{
"value": "5.8.6+ds1-3",
"evidence": "/affected/0/versions"
},
{
"value": "6.1.1+ds1-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "podman",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.8.6+ds1-3",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "5.4.2+ds1-2",
"evidence": "/affected/1/versions"
},
{
"value": "5.6.1+ds1-1",
"evidence": "/affected/1/versions"
},
{
"value": "5.6.1+ds1-2",
"evidence": "/affected/1/versions"
},
{
"value": "5.6.1+ds2-2",
"evidence": "/affected/1/versions"
},
{
"value": "5.6.1+ds2-3",
"evidence": "/affected/1/versions"
},
{
"value": "5.6.2+ds1-1",
"evidence": "/affected/1/versions"
},
{
"value": "5.6.2+ds1-2",
"evidence": "/affected/1/versions"
},
{
"value": "5.6.2+ds1-3",
"evidence": "/affected/1/versions"
},
{
"value": "5.6.2+ds1-3+exp1",
"evidence": "/affected/1/versions"
},
{
"value": "5.6.2+ds1-4",
"evidence": "/affected/1/versions"
},
{
"value": "5.7.0+ds2-1",
"evidence": "/affected/1/versions"
},
{
"value": "5.7.0+ds2-2",
"evidence": "/affected/1/versions"
},
{
"value": "5.7.0+ds2-3",
"evidence": "/affected/1/versions"
},
{
"value": "5.8.0+ds1-1",
"evidence": "/affected/1/versions"
},
{
"value": "5.8.1+ds1-1",
"evidence": "/affected/1/versions"
},
{
"value": "5.8.1+ds1-2",
"evidence": "/affected/1/versions"
},
{
"value": "5.8.1+ds1-3",
"evidence": "/affected/1/versions"
},
{
"value": "5.8.2+ds1-1",
"evidence": "/affected/1/versions"
},
{
"value": "5.8.2+ds1-2",
"evidence": "/affected/1/versions"
},
{
"value": "5.8.2+ds1-3",
"evidence": "/affected/1/versions"
},
{
"value": "5.8.3+ds1-1",
"evidence": "/affected/1/versions"
},
{
"value": "5.8.4+ds1-1",
"evidence": "/affected/1/versions"
},
{
"value": "5.8.4+ds1-2",
"evidence": "/affected/1/versions"
},
{
"value": "5.8.6+ds1-1",
"evidence": "/affected/1/versions"
},
{
"value": "5.8.6+ds1-2",
"evidence": "/affected/1/versions"
}
]
}
],
"severity": "critical",
"structured": {
"id": "DEBIAN-CVE-2026-94603",
"aliases": [
"DEBIAN-CVE-2026-94603"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "podman",
"purl": "pkg:deb/debian/podman?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"5.4.2+ds1-2",
"5.6.1+ds1-1",
"5.6.1+ds1-2",
"5.6.1+ds2-2",
"5.6.1+ds2-3",
"5.6.2+ds1-1",
"5.6.2+ds1-2",
"5.6.2+ds1-3",
"5.6.2+ds1-3+exp1",
"5.6.2+ds1-4",
"5.7.0+ds2-1",
"5.7.0+ds2-2",
"5.7.0+ds2-3",
"5.8.0+ds1-1",
"5.8.1+ds1-1",
"5.8.1+ds1-2",
"5.8.1+ds1-3",
"5.8.2+ds1-1",
"5.8.2+ds1-2",
"5.8.2+ds1-3",
"5.8.3+ds1-1",
"5.8.4+ds1-1",
"5.8.4+ds1-2",
"5.8.6+ds1-1",
"5.8.6+ds1-2",
"5.8.6+ds1-3",
"6.1.1+ds1-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-94603.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.8.6+ds1-3"
}
]
}
],
"package": {
"name": "podman",
"purl": "pkg:deb/debian/podman?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"5.4.2+ds1-2",
"5.6.1+ds1-1",
"5.6.1+ds1-2",
"5.6.1+ds2-2",
"5.6.1+ds2-3",
"5.6.2+ds1-1",
"5.6.2+ds1-2",
"5.6.2+ds1-3",
"5.6.2+ds1-3+exp1",
"5.6.2+ds1-4",
"5.7.0+ds2-1",
"5.7.0+ds2-2",
"5.7.0+ds2-3",
"5.8.0+ds1-1",
"5.8.1+ds1-1",
"5.8.1+ds1-2",
"5.8.1+ds1-3",
"5.8.2+ds1-1",
"5.8.2+ds1-2",
"5.8.2+ds1-3",
"5.8.3+ds1-1",
"5.8.4+ds1-1",
"5.8.4+ds1-2",
"5.8.6+ds1-1",
"5.8.6+ds1-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-94603.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-23T17:47:22.844040045Z",
"provider": "osv",
"upstream": [
"CVE-2026-94603"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2026-94603"
]
},
"related_cves": [
{
"value": "CVE-2026-94603",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 416608,
"published_at": "2026-10-13T17:17:49.123+00:00"
}