Summary
Podman: The podman run command can be instructed to disable almost all sandboxing by image annotation
Workarounds
Images being pulled should be scanned for the io.podman.annotations.checkpoint.runtime.name annotation, and rejected if it is present. Podman does not presently have the ability to perform this scanning and rejection automatically.
Also not that rootless containers are not affected as they do not support checkpoint/restore at all currently.
Credits
This vulnerability was discovered by ADA Logics Ltd using Anthropic's Claude models.
Impact
Podman v4.4.0 added a feature where container checkpoints (from the podman container checkpoint command) could be distributed via OCI registry, and pulled from that registry and run via the podman run command. This allowed easy transfer of checkpoints between systems. However, checkpoints allow complete control of how the container is created - including full control of the container sandbox. When podman run detects a checkpoint, it will silently ignore all user input regarding how the container should be created - for example, podman run --cap-drop=ALL on an image that is determined to be a checkpoint will ignore --cap-drop=all and use the set of capabilities specified by the checkpoint image instead, which could include all capabilities. Podman identifies checkpoint images by looking for an annotation, io.podman.annotations.checkpoint.runtime.name. If this annotation is set, the image is treated as a checkpoint. Conflating container images and checkpoints in podman run allows inherently insecure behavior as the image can now control how it is executed. The Podman Maintainers have determined that the safest course of action is to remove this functionality.
CVE-2026-94603 has a CVSS score of 10.0 (Critical). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (5.8.8, 6.1.3); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
The commit introducing this functionality was reverted.
3721ff82ffb44a4ceeaecc5abd3808e924a6b669 c74b1d37b3fb834b0de43e176565d9d8c254b627 fa6cef22c2baf3987b581c673bb416ef0585daf7 (main)
ea9243e04d1db3886dc3a51ee3300ffb547cfc02 450c64426dbcff1097d3c7911d791101e3d16f4c 2d05a7c61f022d4f24980ea6d307fa53da2b8692 (v6.1)
7728ba0a90094408ad9078e36c3622a651d49616 24706290d5c974f078d8ca284026802515f28e92 29c8c6e50607df7a7d735ace09ff0ea099c0b3e0 (v5.8)
Frequently Asked Questions
- What is CVE-2026-94603? CVE-2026-94603 is a critical-severity security vulnerability in github.com/containers/podman (go), affecting versions >= 4.4.0, < 5.8.8. It is fixed in 5.8.8, 6.1.3.
- How severe is CVE-2026-94603? CVE-2026-94603 has a CVSS score of 10.0 (Critical). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which packages are affected by CVE-2026-94603?
github.com/containers/podman(go) (versions >= 4.4.0, < 5.8.8)go.podman.io/podman/v6(go) (versions >= 6.0.0, < 6.1.3)
- Is there a fix for CVE-2026-94603? Yes. CVE-2026-94603 is fixed in 5.8.8, 6.1.3. Upgrade to this version or later.
- Is CVE-2026-94603 exploitable, and should I be worried? Whether CVE-2026-94603 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-94603 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-94603?
- Upgrade
github.com/containers/podmanto 5.8.8 or later - Upgrade
go.podman.io/podman/v6to 6.1.3 or later
- Upgrade