# CVE-2026-94603: Podman sandbox bypass via checkpoint image annotation

Source: https://junglewise.ai/threats/cve-2026-94603-podman-the-podman-run-command-can-be-instructed-to-disable-almost  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-15  
License: CC BY 4.0 with a link back

CVE-2026-94603 · Severity: critical · CVSS 10 · Published 2026-10-13

Podman is a container runtime that manages isolated application environments. A flaw in how `podman run` processes checkpoint images allows an attacker to distribute a malicious container image that ignores security restrictions specified by the user, potentially running with full capabilities and disabled sandboxing. An attacker could exploit this to escape container isolation and compromise the host system.

Technologies: [github.com/containers/podman (Go)](https://junglewise.ai/threats/technologies/github-com-containers-podman), [github.com/containers/podman/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-containers-podman-v2), [github.com/containers/podman/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-containers-podman-v3), [github.com/containers/podman/v4 (Go)](https://junglewise.ai/threats/technologies/github-com-containers-podman-v4), [github.com/containers/podman/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-containers-podman-v5). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-94603 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-94603 being exploited in the wild.

**How severe is CVE-2026-94603?** Critical severity, with a CVSS score of 10, published 13 October 2026.

**Which products and versions are affected?** github.com/containers/podman (Go) >= 4.4.0, < 5.8.8, SEMVER:introduced=0, SEMVER:introduced=4.4.0,fixed=5.8.8; github.com/containers/podman/v2 (Go) SEMVER:introduced=0; github.com/containers/podman/v3 (Go) SEMVER:introduced=0; github.com/containers/podman/v4 (Go) SEMVER:introduced=4.4.0; and 3 more.

**Is there a fix for CVE-2026-94603?** Yes. github.com/containers/podman (Go): upgrade to 5.8.8 or later; github.com/containers/podman/v5 (Go): upgrade to 5.8.8 or later; go.podman.io/podman/v6 (Go): upgrade to 6.1.3 or later. Until then: Scan images being pulled for the `io.podman.annotations.checkpoint.runtime.name` annotation and reject any images that have it present, since Podman does not automatically perform this validation. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-94603 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-94603?** Check whether you run github.com/containers/podman (Go), github.com/containers/podman/v2 (Go), github.com/containers/podman/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/containers/podman (Go): upgrade to 5.8.8 or later

  ```sh
  go get github.com/containers/podman@v5.8.8
  ```

- github.com/containers/podman/v5 (Go): upgrade to 5.8.8 or later

  ```sh
  go get github.com/containers/podman/v5@v5.8.8
  ```

- go.podman.io/podman/v6 (Go): upgrade to 6.1.3 or later

  ```sh
  go get go.podman.io/podman/v6@v6.1.3
  ```


Scan images being pulled for the `io.podman.annotations.checkpoint.runtime.name` annotation and reject any images that have it present, since Podman does not automatically perform this validation.

## Technical details

Podman v4.4.0 introduced checkpoint distribution via OCI registry. When `podman run` detects an image with the `io.podman.annotations.checkpoint.runtime.name` annotation, it silently ignores user-supplied security parameters (such as `--cap-drop=ALL`) and uses the sandbox configuration stored in the checkpoint instead. This allows a checkpoint image to execute with arbitrary capabilities and sandbox settings. Rootless containers are not affected as they do not support checkpoint/restore.

## Affected products

- Podman Podman 4.4.0 and later

## Identifiers

- CVE-2026-94603
- GHSA-2cvf-wqm6-wr9g
- GO-2026-6770

## Timeline

- 2026-10-15: disclosed

## Related threats

- [Podman quadlet install incomplete file truncation](https://junglewise.ai/threats/cve-2026-19730-podman-quadlet-install-incomplete-file-truncation)
- [Podman host environment variable leak via malformed container image](https://junglewise.ai/threats/cve-2026-57231-podman-host-environment-variable-leak-via-malformed-container)
- [Podman symlink traversal in WORKDIR path resolution](https://junglewise.ai/threats/cve-2026-55686-podman-symlink-traversal-in-workdir-path-resolution)
- [Podman command injection in HyperV machine backend](https://junglewise.ai/threats/cve-2026-33414-podman-command-injection-in-hyperv-machine-backend)
- [Podman data persistence in bind mounts during build](https://junglewise.ai/threats/cve-2025-4953-podman-data-persistence-in-bind-mounts-during-build)