Podman: crafted image tar passed to podman load writes files outside the target as the calling user

Impact

A crafted tar archive fed to podman load can create files on the host with the privileges of the user running Podman. Anywhere a pipeline loads image tarballs it did not build - an air-gapped GPU node importing a model-serving image, a CI runner loading an artifact, a node bootstrap script - the archive author chooses paths on the host. Run as root, which is common on bare-metal GPU nodes doing image preload, that is host file write and a straightforward path to persistence on a node that is expensive to drain and rebuild. Red Hat scores it 5.5 with limited confidentiality, integrity and availability impact; it needs the operator to load a hostile archive, so it is not remotely triggerable on its own.

Who can reach it

Local: whoever can get a crafted tar in front of podman load. No Podman authentication is involved - the privilege obtained is that of the user invoking the command, so the severity turns on whether that user is root.

What to do

Update the podman package from your distribution (Red Hat tracks this across RHEL 8, 9, 10, OpenShift Container Platform 4 and Dev Spaces; check the errata for your stream, as the record names no fixed version). The fix takes effect on the next invocation - no daemon to restart, no node drain or reboot. Until patched, only load image archives from sources you trust, and do not run podman load as root on untrusted input.

References

Related entries

• cosign / sigstore: A crafted bundle verifies successfully even though the embedded Rekor entry does not referenceCVE-2026-22703 · cosign / sigstoreMedium
• Kuma: kumactl HTTPS profile without a CA file skips verification and leaks admin API tokensCVE-2026-50166 · Kuma kumactl (HTTPS control-plane profile TLS verification)Medium
• ACM must-gather: wrapper CRs embedding Secret data are collected unredacted into the support archiveCVE-2026-73834 · Red Hat Advanced Cluster Management must-gather (ACM wrapper CRs embedding Secret data)Medium
• ACM must-gather: cluster Proxy object dumped raw, exposing proxy basic-auth credentialsCVE-2026-75485 · Red Hat Advanced Cluster Management must-gather (cluster Proxy object collection)Medium
• runc (linux.resources.devices cgroup list handling): MULTI-TENANT DEVICE ISOLATION: runc implemented theNCVD-2020-005-runc-linux-resources-devices-cgr · runc (linux.resources.devices cgroup list handling)Medium
• etcd (write-ahead log, user authentication entries): CONTROL-PLANE CREDENTIALS AT REST IN CLEARTEXT: etcd writes theNCVD-2020-006-etcd-write-ahead-log-user-authen · etcd (write-ahead log, user authentication entries)Medium