Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Podman tools may run unsafe image code

published 1 month ago

Summary

The Podman, Podman-Docker, Podman-Machine, Podman-Remote, and PodmanSH packages from Red Hat have a bug that could let specially crafted container images cause unexpected behavior or compromise. This could affect the stability and security of containers you run. Install the latest Red Hat Hardened Images update to fix the bug and improve protection.

What to do

Update redhat podman to version 0:6.0.2-2.3.hum1.
Update redhat podman-docker to version 0:6.0.2-2.3.hum1.
Update redhat podman-machine to version 0:6.0.2-2.3.hum1.
Update redhat podman-remote to version 0:6.0.2-2.3.hum1.
Update redhat podmansh to version 0:6.0.2-2.3.hum1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:hummingbird:1	redhat	podman	< 0:6.0.2-2.3.hum1 Fix: upgrade to 0:6.0.2-2.3.hum1
Red Hat:hummingbird:1	redhat	podman-docker	< 0:6.0.2-2.3.hum1 Fix: upgrade to 0:6.0.2-2.3.hum1
Red Hat:hummingbird:1	redhat	podman-machine	< 0:6.0.2-2.3.hum1 Fix: upgrade to 0:6.0.2-2.3.hum1
Red Hat:hummingbird:1	redhat	podman-remote	< 0:6.0.2-2.3.hum1 Fix: upgrade to 0:6.0.2-2.3.hum1
Red Hat:hummingbird:1	redhat	podmansh	< 0:6.0.2-2.3.hum1 Fix: upgrade to 0:6.0.2-2.3.hum1

Original advisory text

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

References

https://access.redhat.com/errata/RHSA-2026:62771 Vendor Advisory
https://images.redhat.com/ Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-15789 Third Party Advisory
https://access.redhat.com/security/updates/classification/ Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62771.... Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2503742 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-15789 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-15789 Vendor Advisory
https://github.com/moby/buildkit/security/advisories/GHSA-g2h8-426c-7976 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Timeline

Published22 Sep 2026

Updated23 Sep 2026

First seen23 Sep 2026

Sources

RHSA-2026:62771 · OSV

Track software like this

Free during beta