CVE-2026-57231: Podman: Malformed Image can trick podman run into leaking host environment variables into the container
An container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk (*) will cause podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all podman environment variables that are set in the session from where the container is launched.
References
- github.com/advisories/GHSA-4hq8-gpf5-8p68
- github.com/podman-container-tools/podman/commit/6c431b73dbf8e4b20b778644d7a80caebdb75050
- github.com/podman-container-tools/podman/releases/tag/v5.8.4
- github.com/podman-container-tools/podman/releases/tag/v6.0.0
- github.com/podman-container-tools/podman/security/advisories/GHSA-4hq8-gpf5-8p68
- nvd.nist.gov/vuln/detail/CVE-2026-57231
Code Behaviors & Features
Detect and mitigate CVE-2026-57231 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →