Podman: auto-update trusts image labels to pick which systemd services to restart

Impact

Podman auto-update reads metadata labels from the container image to decide which system services to restart. Someone who controls an image the host runs can make auto-update restart arbitrary services with Podman's privileges. With rootful Podman that includes services that shut the host down. The result is denial of service on the node, not code execution. On a GPU node that means killing running jobs and possibly taking the machine offline.

Who can reach it

An attacker who can get a crafted image run on a host where podman auto-update is in use. That could be through a compromised or untrusted registry or image that an operator deploys. The attacker needs no credentials on the host, but someone has to run the image, so user interaction is required.

What to do

Apply the patched podman packages (RHSA-2026:98992 for RHEL; check your distribution for others). Running containers do not need a reboot, but any podman auto-update timers will use the new binary on their next run. Until patched, disable podman-auto-update for containers built from untrusted images, and avoid running auto-update rootful.

References

Related entries

• KubeVirt: virt-handler notify server derives VMI identity from the request body without validating the connectionCVE-2026-13208 · KubeVirtMedium
• kubectl cp on Windows: a malicious in-container tar writes files to arbitrary local pathsCVE-2026-19444 · Kubernetes kubectl (kubectl cp on Windows clients)Medium
• ingress-nginx: Admission controller denial of serviceCVE-2026-24514 · ingress-nginxMedium
• CSI Driver NFS: Path traversal via `subDir` lets a tenant delete unintended directories on the shared NFS serverCVE-2026-3864 · CSI Driver NFSMedium
• CSI Driver SMB: Same `subDir` path traversal against a shared SMB serverCVE-2026-3865 · CSI Driver SMBMedium
• Contour: fallback certificate with JWT providers lets SNI-less requests skip JWT verificationCVE-2026-50149 · Projectcontour Contour ingress controller (HTTPProxy fallback certificate + jwtProviders)Medium