Critical Security Update for Podman: Addressing Directory Traversal Vulnerability
Summary
ALSA-2026:38495: Important: podman security update. Affects podman versions < 7:5.8.2-5.el10_2.alma.1. Fixed in 7:5.8.2-5.el10_2.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Podman is a powerful tool designed for managing pods, container images, and containers. It is part of the libpod library, which facilitates the use of container pods, a concept integral to Kubernetes. Podman allows users to run containers without requiring a daemon, making it lightweight and efficient. However, a recent vulnerability has been identified that could potentially compromise the security of systems utilizing Podman.
Vulnerability Detail
The vulnerability stems from a symlink following issue in the Go programming language's os.Root function, which allows for directory traversal. This could enable an attacker to access restricted directories and files, leading to unauthorized data exposure or manipulation. The specific identifier for this vulnerability is CVE-2026-39822, which highlights the critical nature of the flaw and its potential impact on systems using Podman.
How To Fix
Minimum fixed version
7:5.8.2-5.el10_2.alma.1
This is the first release that contains the fix.
sudo dnf update podmanTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to sensitive directories and files to mitigate the risk of exploitation until the update is applied. Additionally, monitoring for unusual activities in the system can help identify potential exploitation attempts.
Conclusion
In summary, the identified vulnerability in Podman poses a significant security risk due to its potential for directory traversal. Users are strongly advised to update to the patched version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for podman →
FAQ
Podman is a tool for managing containers and pods, allowing users to run and manage containerized applications without a daemon.
CVE-2026-39822 is a vulnerability in the Go programming language that allows for directory traversal due to symlink following, potentially exposing sensitive files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability could allow unauthorized access to sensitive files and directories, leading to data breaches or system compromise.
It is recommended to regularly check for updates and apply them promptly to ensure your system is protected against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for podman.
