Security Advisory catalog CVE-2026-121885 Historical advisory recorded 13 Nov 2026 14:56:54 UTC. Read the latest advisory .
cve-program · CVE-2026-121885 Published
A flaw was found in Podman. An attacker can trigger a Denial of Service (DoS) by supplying a container image containing crafted metadata labels. Podman's auto-update mechanism improperly trusts these image labels to determine which system services to restart. If a user runs the malicious container and auto-update processes it, arbitrary system services are restarted with the user's privileges, potentially allowing an attacker to shut down the host system when Podman runs with administrative privileges.
Read the publisher's advisory Affected versions, risk and source history
cve-program · CVE-2026-121885 Published podman https://github.com/podman-container-tools/podman
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"versions": [
{
"status": "affected",
"version": "1.8.2",
"lessThan": "5.8.10",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.0",
"lessThan": "6.2.0",
"versionType": "semver"
}
],
"packageName": "podman",
"collectionURL": "https://github.com/podman-container-tools/podman",
"defaultStatus": "unaffected"
} podman-main https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "podman-main",
"defaultStatus": "affected",
"versions": [
{
"version": "6.1.4-1.4.hum1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:hummingbird:1"
]
} podman https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "podman",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
]
} container-tools:rhel8/podman https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "container-tools:rhel8/podman",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
]
} podman https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "podman",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
} podman https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "podman",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:openshift:4"
]
} Original source record · Cite this exact observation · Complete original publisher JSON