GHSA-4hq8-gpf5-8p68: Podman: Malformed Image can trick podman run into leaking host environment variables into the container
HIGHHigh-risk vulnerability — CVSS 7.5
## Summary An container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk (*) will cause podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all podman environment variables that are set in the session from where the container is launched. …
CVE · detail
- CVE-2026-57231nvd ↗EPSS 0.44%
Early access
Get the next one first.
Early access opens the actor API and MCP server first, plus alerts when an adversary you follow lands on the wire. One email when it's ready. Nothing else, ever.
bot-protected