Logo
Retour à la veille

CVE-2026-94603

Publié : 13 octobre 2026
Modifié : 13 octobre 2026
Lien officiel NVD
Score CVSS
10
CRITICAL

Description détaillée

Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Références et Patchs

https://github.com/podman-container-tools/podman/commit/24706290d5c974f078d8ca284026802515f28e92https://github.com/podman-container-tools/podman/commit/3721ff82ffb44a4ceeaecc5abd3808e924a6b669https://github.com/podman-container-tools/podman/commit/450c64426dbcff1097d3c7911d791101e3d16f4chttps://github.com/podman-container-tools/podman/commit/7728ba0a90094408ad9078e36c3622a651d49616https://github.com/podman-container-tools/podman/commit/c74b1d37b3fb834b0de43e176565d9d8c254b627https://github.com/podman-container-tools/podman/commit/ea9243e04d1db3886dc3a51ee3300ffb547cfc02https://github.com/podman-container-tools/podman/releases/tag/v5.8.8https://github.com/podman-container-tools/podman/releases/tag/v6.1.3https://github.com/podman-container-tools/podman/security/advisories/GHSA-2cvf-wqm6-wr9g

Dernières Vulnérabilités

CVE-2026-95502

A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server.

VOIR DÉTAILS

CVE-2026-93294

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.

VOIR DÉTAILS

CVE-2026-92892

Potential arbitrary code execution, under specific configurations.

VOIR DÉTAILS