Is CVE-2026-55686 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55686 being exploited in the wild.

How severe is CVE-2026-55686?

Medium severity, with a CVSS score of 5.3, published 26 June 2026.

Which products and versions are affected?

Containers Podman <= 3.4.7, <= 4.9.5, <= 5.7.0; github.com/containers/podman (Go) SEMVER:introduced=0; github.com/containers/podman/v2 (Go) SEMVER:introduced=0; github.com/containers/podman/v3 (Go) <= 3.4.7, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=3.4.7; and 2 more.

Is there a fix for CVE-2026-55686?

Yes. github.com/containers/podman/v5 (Go): upgrade to 5.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55686 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-55686?

Check whether you run Containers Podman, github.com/containers/podman (Go), github.com/containers/podman/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55686: Podman symlink traversal in WORKDIR path resolution

Q: Which products and versions are affected?

Containers Podman <= 3.4.7, <= 4.9.5, <= 5.7.0; github.com/containers/podman (Go) SEMVER:introduced=0; github.com/containers/podman/v2 (Go) SEMVER:introduced=0; github.com/containers/podman/v3 (Go) <= 3.4.7, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=3.4.7; and 2 more.

Q: Is there a fix for CVE-2026-55686?

Yes. github.com/containers/podman/v5 (Go): upgrade to 5.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55686 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-55686?

Check whether you run Containers Podman, github.com/containers/podman (Go), github.com/containers/podman/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55686 · Severity: medium · CVSS 5.3 · Published 2026-06-26

Podman is a tool used to manage and run containerized applications. A vulnerability exists where running a specially crafted, malicious container image can cause Podman to create directories or change file ownership on the host computer's filesystem instead of inside the container. This could allow an attacker to interfere with host operations or potentially gain unauthorized access to host files.

Technologies: Containers Podman, github.com/containers/podman (Go), github.com/containers/podman/v2 (Go), github.com/containers/podman/v3 (Go), github.com/containers/podman/v4 (Go), github.com/containers/podman/v5 (Go). Vendors: Containers, Go.

Quick answers

Is CVE-2026-55686 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55686 being exploited in the wild.
How severe is CVE-2026-55686?: Medium severity, with a CVSS score of 5.3, published 26 June 2026.
Which products and versions are affected?: Containers Podman <= 3.4.7, <= 4.9.5, <= 5.7.0; github.com/containers/podman (Go) SEMVER:introduced=0; github.com/containers/podman/v2 (Go) SEMVER:introduced=0; github.com/containers/podman/v3 (Go) <= 3.4.7, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=3.4.7; and 2 more.
Is there a fix for CVE-2026-55686?: Yes. github.com/containers/podman/v5 (Go): upgrade to 5.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55686 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-55686?: Check whether you run Containers Podman, github.com/containers/podman (Go), github.com/containers/podman/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/containers/podman/v5 (Go): upgrade to 5.7.1 or later
```
go get github.com/containers/podman/v5@v5.7.1
```

Technical details

A symlink traversal vulnerability exists in Podman's 'resolveWorkDir()' function within libpod. When a container image defines a WORKDIR path containing symbolic links, Podman may fail to properly scope the path resolution to the container's rootfs. An attacker can exploit this by providing a malicious image that, when executed, creates directories or modifies file ownership on the host filesystem. While directory creation is straightforward, modifying ownership typically requires a race condition involving a separate malicious process on the host. The issue is fixed in version 5.7.1 by utilizing 'SecureJoin' and delegating link handling to the OCI runtime.

Affected products

podman-container-tools Podman >= 3.0.0, < 5.7.1

Identifiers

CVE-2026-55686
GHSA-q6r4-3wmg-fwcq
GO-2026-5568

Timeline

2026-06-17: advisory: GitHub Security Advisory published
2026-06-26: disclosed: CVE published to NVD
2026-06-26: patched: Fix released in version 5.7.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.