Podman Checkpoint Image Security Bypass

CVE-2026-94603 describes a security vulnerability in Podman that conflates container images with container checkpoints. Introduced in version 4.4.0, a feature enabled the distribution of container checkpoints via OCI registries to facilitate system migration. Podman identifies these images using the annotation io.podman.annotations.checkpoint.runtime.name.

When podman run executes an image carrying this annotation, it prioritizes the checkpoint's internal configuration over any command-line security arguments provided by the user (e.g., --cap-drop, --security-opt). This allows a malicious or compromised container image to ignore intended sandboxing limitations, potentially executing with elevated capabilities. The Podman maintainers have opted to remove this checkpoint distribution functionality entirely to mitigate the risk of insecure container execution. Rootless containers are not currently affected as they do not support the checkpoint and restore feature.

Impact

This vulnerability affects users of Podman versions 4.4.0 through 5.8.7 and 6.0.0 through 6.1.2. If a user pulls and runs a malicious container image specifically crafted with this annotation, they may unknowingly bypass host-level security restrictions enforced by the Podman daemon. This could lead to container escapes or the execution of processes with unauthorized privileges, impacting any environment relying on Podman for secure container isolation.

Recommendation

• Upgrade to Podman version 5.8.8 or later, or 6.1.3 or later, to receive the patch that removes checkpoint distribution functionality.
• Implement an image scanning policy to inspect OCI manifests for the io.podman.annotations.checkpoint.runtime.name annotation before allowing container execution.
• Favor the use of rootless container configurations where feasible, as these do not support the vulnerable checkpoint mechanism.