vulnerability

CVE-2026-57231

NVD HIGH 7.5 · published 2026-06-26 · 1 on the wire

Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk (*) will cause podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all podman environment variables that are set in the session from where the container is launched. This vulnerability is fixed in 5.8.4 and 6.0.0.

Exploited in the wild

Not on KEV

Not in CISA's Known Exploited Vulnerabilities catalogue as of the last daily pull. Absence is not proof of safety.

EPSS · 30-day forecast

Chance of exploitation in the next 30 days, 35th percentile of all CVEs. A forecast; KEV outranks it.

CVSS · NVD

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Internet exposure

—

No exposure census on this CVE's dispatches.

On the wire1

24 SepGHSA-4hq8-gpf5-8p68: Podman: Malformed Image can trick podman run into leaking host environment variables into the containerVULN

References

Early access

Watch this one?

Early access opens alerts first — one email when a CVE you follow lands on KEV or an adversary you follow lands on the wire. Nothing else, ever.

bot-protected