Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk (*) will cause podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all podman environment variables that are set in the session from where the container is launched. This vulnerability is fixed in 5.8.4 and 6.0.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-06-26 | 1 | Disclosure1 |
| 2026-06-27 | 1 | Patch1 |
CVE-2026-57231 Environment Variable Injection in Podman Versions 1.8.1 Through 5.8.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-57231
Post summary
A new vulnerability (CVE-2026-57231) involving environment variable injection has been disclosed, affecting Podman versions 1.8.1 through 5.8.3.
Podman 5.8.4 fixes CVE-2026-57231: a malicious image with malformed Env entries could leak host environment variables into the container, even using glob operators to grab them without knowing the names. Do you ever inspect the Env metadata of an image before you pull it?
Post summary
Podman 5.8.4 releases a patch for CVE‑2026‑57231, fixing a flaw where malicious images could leak host environment variables through malformed Env entries and glob operators.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | podman_project | podman | - | - | - |
| App | podman_project | podman | 6.0.0 | - | - |