CVE-2026-94603

Executive Summary

CVE-2026-94603 is a critical (CVSS 10.0) sandbox-escape class vulnerability in Podman, the OCI container and pod management tool. From version 4.4.0 until 5.8.8 and 6.1.3, podman run treats any image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently discards user-supplied container creation restrictions, including --cap-drop=ALL. This allows an image author to substitute weaker sandbox settings and a broader capability set than the operator explicitly requested. Rootless containers are unaffected because checkpoint/restore are unavailable in that mode. Any environment that runs untrusted or third-party images with rootful Podman is in scope.

Technical Analysis

The vulnerability resides in the container creation path of Podman. When an operator invokes podman run with restrictive flags — most notably --cap-drop=ALL, but conceptually any user-supplied container creation restriction — the expected behavior is that those restrictions are authoritative. The NVD description states that Podman instead inspects the image for the annotation io.podman.annotations.checkpoint.runtime.name. If present, the image is "treated as a checkpoint," and in that mode Podman "silently ignores user-supplied container creation restrictions such as --cap-drop=ALL." The result is that "image-controlled checkpoint state" is allowed to "select weaker sandbox settings and capabilities."

This is an image-controlled trust-boundary violation, mapped to CWE-693 (Protection Mechanism Failure). The security control that fails is the explicit operator-specified constraint on container isolation and Linux capability sets. Because the trigger is an OCI image annotation rather than a runtime exploit, no memory-corruption or race primitive is required: the image author simply ships metadata that redirects Podman's creation logic into the checkpoint path, where the annotation-supplied state — not the CLI flags — dictates the effective sandbox and capability configuration.

Two properties sharpen the risk:

1. Silent failure. The restriction is ignored without an error or a prominent warning, so the operator believes --cap-drop=ALL took effect when the effective container runs with a wider capability set and a weaker sandbox profile.
2. Annotation is transportable. The triggering condition lives inside the image manifest, so it is delivered through the normal image-sharing supply chain — registries, CI artifacts, tarballs, and mirrors — and requires no modification to the host or the podman binary.

Scope constraints stated in the advisory: rootless containers are not affected, because checkpoint and restore are unavailable in rootless mode. The flaw therefore only manifests for rootful Podman. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H assigns scope change (S:C) and high confidentiality, integrity, and availability impact — consistent with a container escaping its intended confinement and reaching the host or adjacent workloads. The user-interaction-none rating reflects CVSS 3.1 convention (running a container is treated as a system action rather than a end-user interaction), not a claim that no participation is required. No public proof-of-concept, exploit code, or Nuclei template was identified in the provided intelligence, and no specific file, function, or symbol names appear in the description; the analysis above is therefore limited to the documented vulnerability class and mechanism.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. An adversary identifies environments running rootful Podman in the affected ranges and consuming images from sources the attacker can influence. In multi-tenant build farms, shared registries, or CI/CD pipelines that pull image artifacts from third parties, the attacker's leverage is the ability to publish or substitute an image. The attacker is not required to have local access to the target host.

2. Triggering the flaw class. The attacker publishes an image whose manifest carries the io.podman.annotations.checkpoint.runtime.name annotation. When an operator runs the image with Podman in the affected version range and relies on creation restrictions such as --cap-drop=ALL to enforce isolation, Podman classifies the image as a checkpoint and drops the operator's restrictions in favor of the annotation-supplied checkpoint state. There is no exploit payload in the classic sense — the trigger is metadata, and the security failure is the silent substitution of weaker settings.

3. Payload / execution method. Because the operator's capability and sandbox restrictions are no longer enforced, the container starts with the weaker configuration the attacker selected. Any container content the image author controls then runs with privileges the operator believed they had removed. This is a privilege- and isolation-bypass class of attack, not a code-execution bug: the container executes anyway, but under attacker-favored constraints.

4. Post-exploitation impact. With unnecessary capabilities and a weakened sandbox in effect, the attacker has a materially larger attack surface from inside the container — the conditions that normally prevent container-to-host escalation (dropped capabilities, restrictive profiles) are absent or reduced. Given the CVSS scope change (S:C) and high CIA impact, the realistic worst case is escape from intended containment affecting the host and other workloads on the same Podman instance. Rootless deployments are not affected, so blast radius is bounded to rootful Podman.

Impact Assessment

Business impact: Any organization running rootful Podman with untrusted, third-party, or externally sourced images may be running containers with weaker isolation than its policy assumes. The control that fails — capability restriction and sandbox selection — is precisely the control used to satisfy least-privilege and container-hardening requirements, so the technical failure also constitutes a compliance and audit failure: operators have evidence (--cap-drop=ALL on the command line) that does not reflect runtime reality.

Affected systems: Rootful Podman deployments in the affected version ranges (from 4.4.0 until 5.8.8 and 6.1.3). Rootless configurations are explicitly out of scope. Systems that pin an affected version and cannot quickly upgrade — build farms, long-lived CI runners, and appliances bundling Podman — carry the longest exposure.

Blast radius: The CVSS vector implies scope change, meaning impact can propagate beyond the container to the host and co-resident workloads. Confidentiality, integrity, and availability are all rated High. The attack vector is Network (AV:N) and requires no privileges (PR:N), reflecting that the malicious image can be delivered remotely through normal image distribution channels. Public exploit code is absent, but the trigger requires no exploitation skill beyond publishing a crafted image, which lowers the barrier for opportunistic abuse.

Detection Guidance

Sigma Rule

title: Podman run with checkpoint annotation enabling restricted-flag bypass (CVE-2026-94603)
status: experimental
description: Detects podman run invocations that combine hardening flags (e.g. --cap-drop=ALL) with images carrying the io.podman.annotations.checkpoint.runtime.name annotation, indicative of the CVE-2026-94603 restriction-bypass class.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94603
author: valtersit.com
date: 2026-01-01
logsource:
  category: process_creation
  product: linux
detection:
  selection_bin:
    Image|endswith:
      - '/podman'
  selection_cmd:
    CommandLine|contains:
      - 'podman run'
      - 'podman create'
  selection_flags:
    CommandLine|contains:
      - '--cap-drop=ALL'
      - '--cap-drop ALL'
      - '--security-opt'
      - '--privileged=false'
  condition: selection_bin and selection_cmd and selection_flags
fields:
  - Image
  - CommandLine
  - User
falsepositives:
  - Legitimate checkpoint/restore operations using container-checkpoint images
level: medium

YARA Rule

rule CVE_2026_94603_Podman_Checkpoint_Annotation
{
    meta:
        description = "Detects OCI image metadata referencing the Podman checkpoint runtime annotation associated with CVE-2026-94603"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94603"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "high"

    strings:
        $ann = "io.podman.annotations.checkpoint.runtime.name" ascii wide

    condition:
        uint32(0) == 0x04034b50 or        // ZIP-based OCI layer / tar.gz detection hint
        $ann
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94603 Podman checkpoint annotation restriction-bypass image manifest"; flow:established,to_client; http.response_body; content:"io.podman.annotations.checkpoint.runtime.name"; fast_pattern; classtype:attempted-admin; reference:cve,2026-94603; sid:202694603; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name == "podman" and
  process.command_line : ("run", "create") and
  process.command_line : ("--cap-drop=ALL", "--cap-drop ALL", "--security-opt")

Splunk SPL Query

index=linux sourcetype=auditd OR sourcetype=syslog
| search (process_name="podman" OR exe="/usr/bin/podman")
| search command_line="*podman run*" OR command_line="*podman create*"
| search command_line="*--cap-drop=ALL*" OR command_line="*--cap-drop ALL*"
| table _time host user process_name command_line
| sort - _time

Wazuh OSSEC Rule

<group name="cve-2026-94603,podman,">
  <rule id="94603" level="10">
    <if_sid>5501</if_sid>
    <field name="command">podman</field>
    <field name="command">run</field>
    <match>--cap-drop=ALL</match>
    <description>CVE-2026-94603: podman run with restrictive flags may be bypassed by image-controlled checkpoint annotation</description>
    <mitre>
      <id>T1610</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in Podman 5.8.8 and 6.1.3, but no vendor advisory or patch reference was confirmed by tracked sources; validate against upstream before relying on this.

1. Immediate mitigations

   • Prefer rootless Podman where operationally feasible: rootless containers are explicitly unaffected because checkpoint/restore are unavailable in that mode.
   • Stop running untrusted or externally sourced images with rootful Podman. Treat image provenance as a security boundary until the fix is confirmed deployed.
   • Inspect images before use and reject any whose manifest carries io.podman.annotations.checkpoint.runtime.name unless the image is a known, trusted checkpoint artifact.
   • Do not treat --cap-drop=ALL or other creation flags as sufficient protection for untrusted images on affected versions; assume restrictions may be silently ignored.
   • Enforce policy at a layer Podman cannot override (admission control, runtime policy, or host-level confinement) rather than relying solely on CLI flags.

2. Patch / upgrade steps

   • Upgrade rootful Podman to 5.8.8 or 6.1.3 (or later). Confirm the build revision on each node, since distro-maintained packages may lag upstream releases.
   • After upgrading, re-verify effective container capability and sandbox settings on a test image to confirm restrictions are honored.
   • Track upstream CVE-2026-94603 references for the authoritative release-note confirmation, as no patch source was verified in the provided data.

3. Long-term hardening

   • Standardize on signed images from a curated internal registry; block direct pulls of unvetted third-party images in production.
   • Adopt a deny-by-default image policy and continuously monitor Podman release channels for fixes to this class of image-controlled configuration substitution.
   • Alert on any image or invocation that references checkpoint-related annotations in non-checkpoint workflows.

References

• NVD — CVE-2026-94603: https://nvd.nist.gov/vuln/detail/CVE-2026-94603
• CWE-693 — Protection Mechanism Failure: https://cwe.mitre.org/data/definitions/693.html
• MITRE ATT&CK — T1610 Deploy Container: https://attack.mitre.org/techniques/T1610/
• CVSS 3.1 Specification (scope change, S:C): https://www.first.org/cvss/specification-document
• Upstream Podman project (release notes for 5.8.8 and 6.1.3): https://github.com/containers/podman/releases

Threat actor campaign information and exploit-in-the-wild evidence: none available. CISA KEV status: NO. EPSS: not yet scored by FIRST.org. No public PoC, exploit code, or Nuclei template identified in the provided intelligence.