CVE-2026-57231

Katalog CVE

CVSS 7.5 · High EPSS 0,44%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada podman project podman. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk (*) will cause podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all podman environment variables that are set in the session from where the container is launched. This vulnerability is fixed in 5.8.4 and 6.0.0.

Rincian

Terbit di NVD

26 Juni 2026

Terakhir diubah

6 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-668: Exposure of Resource to Wrong Sphere

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/podman-container-tools/podman/commit/6c431b73dbf8e4b20b778644d7a80caebdb75050 patch
• https://github.com/podman-container-tools/podman/security/advisories/GHSA-4hq8-gpf5-8p68 patch · advisory pihak ketiga