Executive brief
Podman's quadlet install command with the --replace flag fails to properly truncate files when replacing Quadlet configuration files. If a new Quadlet is smaller than the original, leftover content from the old file persists, potentially preserving security-sensitive settings like additional capabilities or volume mounts that should have been removed. This could result in unintended container privileges or data exposure when containers are deployed.
Technical details
The vulnerability is a file truncation failure in podman quadlet install --replace, introduced in podman 5.7.0. When replacing a Quadlet file, if the new file is smaller than the original, the file is not truncated to remove leftover content from the old file. The root cause is improper file handling during replacement. An attacker with access to Quadlet files could exploit this by creating a scenario where security-sensitive configuration lines (such as AddCapability directives or additional Volume mounts) at the end of the original file are retained in the replaced file. The attack requires local access and knowledge of the existing Quadlet structure. The vulnerability has been patched in podman 6.0.0 and 5.8.6.
Affected products
- Podman Podman 5.7.0 to 5.8.5, 6.0.0-beta and earlier
Timeline
- 2026-09-24: disclosed
- 2026-09-24: patched: Fixed in podman 6.0.0 and 5.8.6