CVE-2026-55686: Podman WORKDIR Symlink Traversal Vulnerability
Summary
CVE-2026-55686: Podman: WORKDIR symlink traversal vulnerability in github.com/containers/podman. Affected versions are not published. No fix is published. How to fix ↓
Also tracked for
The same CVE-2026-55686 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Podman is an open-source container management tool that allows users to manage containers and images without requiring a daemon. It provides a user-friendly interface for creating, running, and managing containers, making it a popular choice for developers and system administrators. However, a vulnerability has been identified in Podman's handling of the WORKDIR command, which could lead to symlink traversal attacks, potentially compromising the security of the system.
Vulnerability Detail
The vulnerability arises from Podman's improper handling of symbolic links in the WORKDIR command. An attacker could exploit this flaw by creating a malicious symlink that points to sensitive files or directories outside the intended working directory. This could lead to unauthorized access to sensitive data, file manipulation, or even remote code execution, depending on the context in which Podman is used. The vulnerability affects all versions of Podman prior to 5.7.1, making it critical for users to address it promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the WORKDIR command with symlinks until the package is updated. Additionally, ensure that proper file permissions are set to restrict access to sensitive files and directories.
Conclusion
The CVE-2026-55686 vulnerability in Podman poses significant risks due to improper handling of symlinks in the WORKDIR command. Users are strongly advised to update to version 5.7.1 or later to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor for vulnerabilities in your projects.
See every vulnerability recorded for github.com/containers/podman →
FAQ
The vulnerability can lead to unauthorized access to sensitive files and directories, potentially compromising the security of the system.
You can check your Podman version by running 'podman --version' in your terminal. If your version is below 5.7.1, it is affected.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software using just Gopkg.lock. You can also check if your application is affected by this vulnerability using the Vulert playground.
If you cannot update Podman immediately, avoid using the WORKDIR command with symlinks and ensure proper file permissions are set to protect sensitive files.
More information can be found in the official vulnerability database at https://pkg.go.dev/vuln/GO-2026-5568.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containers/podman.
