{"vulnerability": "ghsa-4hq8-gpf5-8p68", "sightings": [{"uuid": "04c57506-ed66-4535-9179-075033fb9292", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-4hq8-gpf5-8p68", "type": "seen", "source": "https://gist.github.com/alon710/1c4b6cbb0ddd0180b37c1412f848c33e", "content": "# CVE-2026-57231: CVE-2026-57231: Podman Malformed Image Host Environment Variable Leak\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-57231\n\n## Summary\nCVE-2026-57231 is a high-severity vulnerability in the Podman container engine. When executing a container from a crafted OCI or Docker image, malformed environment variable entries lacking an equals separator can trigger an unexpected behavior in the spec generation parser. This vulnerability enables a container image to silently exfiltrate host environment variables into the running container workspace, exposing high-privilege credentials and sensitive runtime secrets.\n\n## TL;DR\nA design flaw in Podman's environment variable parser allows malicious container images containing malformed environment configurations to silently import and exfiltrate host shell environment variables, including wildcards, compromising sensitive credentials.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-200, CWE-668\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: 0.00437\n- **Impact**: Confidentiality (High)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Rocky Linux\n- Alma Linux\n- Alibaba Cloud Linux\n- Red Hat Enterprise Linux CoreOS (RHCOS)\n- Red Hat Enterprise Linux\n- openSUSE\n- Oracle Linux\n- Photon OS\n- **podman**: >= 1.8.1, < 5.8.4 (Fixed in: `5.8.4`)\n- **podman**: >= 6.0.0-alpha, < 6.0.0 (Fixed in: `6.0.0`)\n\n## Mitigation\n\n- Upgrade Podman to secure releases (5.8.4+ or 6.0.0+)\n- Enforce strict image pull policies to only permit verified, signed images from trusted internal registries\n- Sanitize shell sessions in sensitive CI/CD runners to prevent long-lived credentials from persisting in execution environments\n- Regularly audit local image storage for environment configurations lacking '=' characters\n\n**Remediation Steps:**\n1. Identify all hosts running Podman versions >= 1.8.1 and < 5.8.4.\n2. Update Podman packages via the local package manager (e.g., 'dnf update podman' or 'apt-get install podman').\n3. Verify the installed version is 5.8.4, 6.0.0, or newer using 'podman --version'.\n4. Implement registry validation tools to detect images with invalid OCI config specifications.\n5. Inspect running environments for potential exposure using auditing commands.\n\n## References\n\n- [CVE-2026-57231 Record](https://www.cve.org/CVERecord?id=CVE-2026-57231)\n- [GitHub Security Advisory GHSA-4hq8-gpf5-8p68](https://github.com/podman-container-tools/podman/security/advisories/GHSA-4hq8-gpf5-8p68)\n- [Podman Fix Commit](https://github.com/podman-container-tools/podman/commit/6c431b73dbf8e4b20b778644d7a80caebdb75050)\n- [Wiz Vulnerability Analysis Portal](https://www.wiz.io/vulnerability-database/cve/cve-2026-57231)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-57231) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T10:30:33.000000Z"}]}