CVE-2026-55686: Podman WORKDIR Symlink Vulnerability – Host Filesystem Compromise

Technical summary

The vulnerability stems from improper handling of symbolic links during container initialization when processing the WORKDIR directive. When Podman sets up a container's working directory, it does not adequately validate whether the path contains symlinks that point outside the container's intended filesystem boundary. A malicious WORKDIR specification can cause Podman to dereference symlinks and perform filesystem operations (mkdir, chown) on unintended host paths. The race condition variant—where ownership changes occur—requires a second malicious or compromised process to mutate the host filesystem tree during the critical window between symlink resolution and operation completion, narrowing the practical attack window. This is classified as a symlink following vulnerability (CWE-61).

Business impact

Organizations running Podman in multi-tenant or untrusted container scenarios face potential host filesystem compromise. An attacker could create or modify directory structures on the host, potentially escalating privileges, planting persistence mechanisms, or disrupting critical services. The impact is most severe in environments where container images come from untrusted sources or where host isolation is assumed to be stronger than it actually is. Development and CI/CD pipelines that build or run third-party container images are particularly at risk.

Affected systems

Podman versions 3.0.0 through 5.7.0 are vulnerable. Version 5.7.1 and later contain the fix. This affects all platforms where Podman runs, including Linux distributions and systems using Podman for local development, container orchestration, or image building. Check your installed Podman version with 'podman --version'.

Exploitability

Exploitation requires a malicious or compromised container image; the attacker has no network path without first gaining the ability to influence image sources. The attack triggers automatically during container startup when WORKDIR is processed, requiring no user interaction beyond running the container. The directory creation variant is straightforward; ownership modification requires favorable race condition timing and a cooperating host-level process, making it less reliable but still feasible in specific scenarios.

Remediation

Upgrade Podman to version 5.7.1 or later. For environments unable to upgrade immediately, restrict container image sources to trusted registries, implement image scanning to detect suspicious WORKDIR directives, and enforce least-privilege policies on the host user running Podman. Consider running Podman in rootless mode to limit the scope of potential filesystem damage.

Patch guidance

Update to Podman 5.7.1 or a later release. Verify patch application by running 'podman --version' and confirming the version number is 5.7.1 or higher. Test upgraded versions in a non-production environment first to ensure compatibility with existing workflows. Consult the Podman project's release notes for any breaking changes or additional security notes in the 5.7.1 release.

Detection guidance

Monitor for unexplained directory creation or ownership changes on the host filesystem that coincide with container startup. Review container images before execution for WORKDIR directives containing suspicious paths (e.g., those with ../, absolute paths, or symlink-heavy components). Implement filesystem integrity monitoring on host directories, particularly those frequently accessed by Podman. Audit logs should capture container image pulls and build events to identify potentially untrusted sources.

Why prioritize this

Although the CVSS score is MEDIUM (5.3), this vulnerability warrants prompt attention because it directly undermines host-container isolation, a foundational security assumption in containerized deployments. The automatic trigger on container startup means vulnerable systems are at risk whenever untrusted images are run. Organizations heavily invested in container workflows should prioritize patching to restore confidence in their isolation boundaries.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects low attack complexity (L), no privileges required (N), no user interaction (N), and integrity impact limited to the host filesystem (I:L). The score does not account for context-specific factors such as image source trust policies, rootless mode deployment, or the reliability gap between simple directory creation and the more complex ownership-change race condition. In high-risk environments (untrusted image sources), the effective risk may be higher; in constrained environments (air-gapped systems, trusted registries only), the risk is lower.

Frequently asked questions