CPE
Podman versions 4.4.0 through 6.1.2 allow container checkpoint images to override runtime security configurations, potentially bypassing user-defined sandbox constraints via the io.podman.annotations.checkpoint.runtime.name annotation.