CVE-2026-57231 Details

A vulnerability in Podman versions 1.8.1 prior to 5.8.4 allows container images with improperly formatted environment variables to exfiltrate host environment variables into the container. Specifically, an image with a variable that has only a key without a value can manipulate Podman into passing that variable from the host environment into the container. This issue is exacerbated by the use of an asterisk (*) in the variable name, which prompts Podman to transfer all host variables into the container. As a result, a malicious image could access and leak all Podman environment variables from the session in which the container is launched.

Users can update to Podman versions 5.8.4 or 6.0.0, both of which include the necessary fix. The vulnerability can also be mitigated by not running untrusted images and inspecting the image's environment variables before execution.