CVE-2026-55686

Name of the Vulnerable Software and Affected Versions Podman versions prior to 5.7.1

Description Running a malicious container image where the WORKDIR path contains a symlink can allow an attacker to create a directory or modify ownership on the host filesystem. Modifying ownership is less likely as it requires a race condition triggered by an untrusted process mutating the host filesystem tree during the dereferencing of the WORKDIR path.

Recommendations Update Podman to version 5.7.1 or later.