Podman: Checkpoint image annotation bypasses container sandbox restrictions
Summary
Podman versions 4.4.0 to before 5.8.8 and 6.0.0 to before 6.1.3 treat an image with the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint when running podman run. In that case, user-supplied restrictions such as --cap-drop=ALL are silently ignored, so the image can select weaker sandbox settings and capabilities. An attacker who can get a malicious image run on a rootful Podman host can therefore escape the intended container restrictions. Rootless Podman is not affected because checkpoint and restore are unavailable in that mode.
Affected
- Podman 4.4.0 up to but not including 5.8.8
- Podman 6.0.0 up to but not including 6.1.3
- Rootless Podman is not affected.
Fixed in
- Podman 5.8.8
- Podman 6.1.3 or later
Workaround
- Upstream documents no configuration-based workaround.
- The advisory recommends scanning pulled images for the checkpoint annotation and rejecting images that carry it. Podman does not do this automatically.
- Run rootless Podman where possible and avoid running untrusted images as root.
- Restrict image pulls to trusted registries.
Exploitation
- CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
- No confirmed in-the-wild exploitation known.
- No public proof of concept confirmed.
Our recommendation
- Update rootful Podman to 5.8.8 or 6.1.3 or later on all hosts.
- Until patched, check whether rootful Podman runs third-party or untrusted images, such as on CI runners or shared build hosts, and restrict these.
- Scan local images for the checkpoint annotation and remove any suspicious images.
- Monitor container creation for unexpected capabilities or disabled security settings.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-2cvf-wqm6-wr9g github.com
- Podman release v6.1.3 github.com
- Podman release v5.8.8 github.com
- Commit 3721ff82 (revert of checkpoint image run support) github.com
- Commit 24706290 (checkpoint image error message) github.com
- OSV entry for DEBIAN-CVE-2026-94603 osv.dev
- VulDB entry 417827 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:24.
Original description (NVD)
Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3.
NVD references (9)
- https://github.com/podman-container-tools/podman/commit/24706290d5c974f078d8ca284026802515f28e92
- https://github.com/podman-container-tools/podman/commit/3721ff82ffb44a4ceeaecc5abd3808e924a6b669
- https://github.com/podman-container-tools/podman/commit/450c64426dbcff1097d3c7911d791101e3d16f4c
- https://github.com/podman-container-tools/podman/commit/7728ba0a90094408ad9078e36c3622a651d49616
- https://github.com/podman-container-tools/podman/commit/c74b1d37b3fb834b0de43e176565d9d8c254b627
- https://github.com/podman-container-tools/podman/commit/ea9243e04d1db3886dc3a51ee3300ffb547cfc02
- https://github.com/podman-container-tools/podman/releases/tag/v5.8.8
- https://github.com/podman-container-tools/podman/releases/tag/v6.1.3
- https://github.com/podman-container-tools/podman/security/advisories/GHSA-2cvf-wqm6-wr9g
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.