Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-2013

NIXPKGS-2026-2013
published 6 hours ago
Podman: Malformed Image can trick podman run into leaking host environment variables into the container
Permalink CVE-2026-57231
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 6 hours ago by @LeSuisse Activity log
  • Created suggestion 12 hours ago
  • @LeSuisse ignored
    9 packages
    • podman-tui
    • podman-bootc
    • cockpit-podman
    • podman-compose
    • podman-desktop
    • nomad-driver-podman
    • python312Packages.podman
    • python313Packages.podman
    • python314Packages.podman
    6 hours ago
  • @LeSuisse accepted 6 hours ago
  • @LeSuisse published on GitHub 6 hours ago
Podman: Malformed Image can trick podman run into leaking host environment variables into the container

Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk (*) will cause podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all podman environment variables that are set in the session from where the container is launched. This vulnerability is fixed in 5.8.4 and 6.0.0.

Affected products

podman
  • ==>= 1.8.1, < 5.8.4

Matching in nixpkgs

pkgs.podman

Program for managing pods, containers and container images

Ignored packages (9)

pkgs.cockpit-podman

Cockpit UI for podman containers

  • nixos-unstable 127
    • nixpkgs-unstable 127
    • nixos-unstable-small 127
  • nixos-26.05 125
    • nixos-26.05-small 125
    • nixpkgs-26.05-darwin 125

Package maintainers