Homepage

Improper Control of Dynamically-Identified Variables The advisory has been revoked - it doesn't affect any version of package podman-docker  (opens in a new tab)

Threat Intelligence

EPSS
0.31% (24th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-PODMANDOCKER-17743733
  • published1 Jul 2026
  • disclosed26 Jun 2026
Report a new vulnerability Found a mistake?

Introduced: 26 Jun 2026

CVE-2026-57231  (opens in a new tab)
CWE-914  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream podman-docker package and not the podman-docker package as distributed by RHEL.

Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk (*) will cause podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all podman environment variables that are set in the session from where the container is launched. This vulnerability is fixed in 5.8.4 and 6.0.0.