Homepage

External Control of System or Configuration Setting The advisory has been revoked - it doesn't affect any version of package podman-remote  (opens in a new tab)

Threat Intelligence

EPSS
0.92% (60th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-PODMANREMOTE-20282470
  • published30 Sept 2026
  • disclosed29 Sept 2026
Report a new vulnerability Found a mistake?

Introduced: 29 Sep 2026

NewCVE-2026-94603  (opens in a new tab)
CWE-15  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream podman-remote package and not the podman-remote package as distributed by RHEL.

Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3.

References