Podman Auto-Update Metadata Label DoS via Malicious Image
CVE-2026-121885 Published on November 10, 2026
Podman: untrusted image labels allow auto-update to restart arbitrary systemd units
A flaw was found in Podman. An attacker can trigger a Denial of Service (DoS) by supplying a container image containing crafted metadata labels. Podman's auto-update mechanism improperly trusts these image labels to determine which system services to restart. If a user runs the malicious container and auto-update processes it, arbitrary system services are restarted with the user's privileges, potentially allowing an attacker to shut down the host system when Podman runs with administrative privileges.
Vulnerability Analysis
CVE-2026-121885 can be exploited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Timeline
Reported to Red Hat.
Made public. 8 days later.
Weakness Type
Reliance on Untrusted Inputs in a Security Decision
The application uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
Products Associated with CVE-2026-121885
Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.
