Podman: kube play follows symlinks in Secret/ConfigMap volumes and overwrites host files

Impact

A crafted Kubernetes YAML played on a node can point a Secret or ConfigMap volume at a symlink resolving to a host path, and podman writes through it. The attacker chooses which file gets clobbered but not the contents, so the realistic outcome is destroying host state rather than planting a backdoor: a CDI spec under /etc/cdi, a driver systemd unit, a kubelet or runtime config. On a GPU node that is enough to make the node stop presenting its accelerators or fail to come back cleanly after a restart, and the fix path is a package upgrade rather than anything you can undo in place. Introduced in podman v4.0.0 and fixed upstream in v5.6.1.

Who can reach it

Any user who can get a Kubernetes YAML played by podman kube play on the host. Authenticated, but no root required (PR:L, no user interaction).

What to do

Upgrade podman to 5.6.1 or the corresponding RHEL erratum build for your release. Package upgrade only: existing containers keep running, but restart any long-lived podman-managed services after the swap. No node reboot required.

References