CVE-2026-57231

Name	CVE-2026-57231
Description	Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk (*) will cause podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all podman environment variables that are set in the session from where the container is launched. This vulnerability is fixed in 5.8.4 and 6.0.0.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
podman (PTS)	trixie	5.4.2+ds1-2	vulnerable
	forky, sid	5.8.2+ds1-3	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
podman	source	(unstable)	(unfixed)

Notes

https://github.com/podman-container-tools/podman/security/advisories/GHSA-4hq8-gpf5-8p68
Fixed by: https://github.com/podman-container-tools/podman/commit/6c431b73dbf8e4b20b778644d7a80caebdb75050 (main)
Fixed by: https://github.com/podman-container-tools/podman/commit/2ae476dd2cf5ee2697b3f721841123c9f8791f6e (v6.0.0)
Fixed by: https://github.com/podman-container-tools/podman/commit/85832029d537c2c0df89e47d4a03d55ba099a848 (v5.8.4)