Critical Podman Flaw Bypasses Security Restrictions via Image Annotations

Podman versions between 4.4.0 and 5.8.8, as well as those from 6.0.0 to 6.1.3, contain a critical security flaw that permits container images to bypass user-supplied restrictions. The National Vulnerability Database identifies this issue as CVE-2026-94603, rating it with a maximum CVSS score of 10.

The vulnerability stems from how Podman processes specific annotations within container images. When an image carries the io.podman.annotations.checkpoint.runtime.name annotation, the tool treats it as a checkpoint. This behavior causes Podman to silently ignore security restrictions provided by the user during container creation, such as --cap-drop=ALL.

Context and Background

According to the NVD record, this weakness is classified under CWE-693, which relates to improper restriction of operations within the sandbox. The flaw allows the checkpoint state controlled by the image to select weaker sandbox settings and capabilities than those intended by the administrator. This effectively undermines the principle of least privilege when users attempt to restrict container permissions.

The issue affects Podman, a widely used tool for managing OCI containers and pods. The vulnerability exists in versions released between 4.4.0 and 5.8.8, as well as in the 6.0.0 series up to 6.1.3. Administrators relying on capability dropping to secure their containers may find their policies ineffective when running images with this specific annotation.

Who Is Affected

Organizations using Podman versions 4.4.0 through 5.8.8 and 6.0.0 through 6.1.3 are potentially exposed to this vulnerability. The flaw specifically impacts rootful container operations where checkpoint and restore features are active. Users who rely on --cap-drop=ALL or similar restrictive flags to mitigate container breakout risks should verify their Podman version immediately.

Rootless containers are not affected by CVE-2026-94603. The NVD record explicitly states that checkpoint and restore functionalities are unavailable in rootless mode, preventing this specific attack vector from succeeding in those environments. This distinction provides a layer of inherent protection for deployments that strictly utilize rootless Podman configurations.

What should you do?

A confirmed fix for CVE-2026-94603 is available in Podman versions 5.8.8 and 6.1.3. Administrators should update their installations to these patched versions or later to eliminate the risk of annotation-based restriction bypass. Until updates are applied, users should exercise caution when running untrusted container images that may contain checkpoint annotations.