CVE-2026-19730

Name of the Vulnerable Software and Affected Versions Podman version 5.8.x

Description The podman quadlet install --replace command fails to truncate existing destination files when opening them with O CREATE|O WRONLY without O TRUNC. On filesystems that do not support reflinks, such as many default RHEL XFS configurations, the ReflinkOrCopy function falls back to io.Copy, which performs a non-truncating write. If the original Quadlet file is larger than the replacement, remnants of the original content are preserved at the end of the file.

This behavior can lead to security risks if sensitive options, such as AddCapability, are intended to be removed but remain active. In the case of Volume Quadlets, this may result in unintended mounts, potentially exposing content to containers. The issue resides in the pkg/domain/infra/abi/quadlet.go and vendor/go.podman.io/storage/pkg/fileutils/reflink linux.go files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.