CVE-2026-19730: 
Podman vulnerability analysis and mitigation

CVE-2026-19730 is an Incomplete Cleanup vulnerability in Podman's quadlet install --replace command that can cause security-sensitive directives from a replaced Quadlet file to persist unintentionally. The flaw was reported by Christopher Lusk (North Echo Security Research) and disclosed on August 13, 2026. It affects Podman versions >= 5.7.0 (patched in v5.8.6) and go.podman.io/podman/v6 prior to v6.0.0. It carries a CVSS v3.1 base score of 4.2 (Medium) (Red Hat Advisory, GitHub Advisory).

The root cause is classified as CWE-459 (Incomplete Cleanup). The vulnerable code in pkg/domain/infra/abi/quadlet.go (lines 338–360) opens the destination file with O_CREATE|O_WRONLY but omits the O_TRUNC flag. On non-reflink-capable filesystems (including many RHEL default XFS configurations), the reflink copy attempt fails and the fallback in vendor/go.podman.io/storage/pkg/fileutils/reflink_linux.go (lines 12–19) uses io.Copy, which performs a non-truncating write. If the replacement Quadlet is shorter than the original, trailing bytes — including security-sensitive directives such as AddCapability or Volume= host-access mounts — survive in the installed unit file, and the command returns success with no warning (Red Hat Advisory, Red Hat Bugzilla).

The primary impact is an integrity failure: security-sensitive Quadlet directives that an administrator explicitly removed (e.g., AddCapability, Volume= host mounts) continue to be enforced after a systemd daemon-reload or reboot, silently undermining the intended security posture. With Volume Quadlets, stale mount directives can unintentionally expose host filesystem content into containers. If a container image is subsequently updated with a compromised or adversarial image, the retained host-access mounts could allow that image to read secrets, modify host files, or disrupt services — representing a limited but real confidentiality, integrity, and availability risk (GitHub Advisory, Red Hat Bugzilla).

The vulnerability requires local access, low privileges, high attack complexity, and user interaction (an administrator must run podman quadlet install --replace with a shorter replacement file), making opportunistic exploitation unlikely. NVD's SSVC assessment classifies exploitation as "poc" with non-automatable attack paths and partial technical impact. The EPSS score is approximately 0.107%, indicating a low probability of exploitation in the wild. There is no evidence of active in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog (Feedly, Red Hat Advisory).

1. Identify a target system: Locate a system running Podman >= 5.7.0 and < 5.8.6 (or v6 < 6.0.0) on a non-reflink-capable filesystem (e.g., XFS without reflink support, common in RHEL defaults).
2. Install an initial Quadlet with sensitive directives: As a low-privileged user with access to Quadlet management, install a Quadlet file containing security-sensitive options at the end, such as AddCapability=SYS_ADMIN or a Volume= host mount directive.
3. Prepare a shorter replacement Quadlet: Create a new, shorter Quadlet file that omits the sensitive directive(s) from the end.
4. Run the replace command: Execute podman quadlet install --replace <shorter_quadlet_dir>/ — the command completes successfully with no warning, but the destination file retains trailing bytes from the original, including the sensitive directives.
5. Verify persistence: Inspect the installed Quadlet file (e.g., via cat $(podman quadlet list --format '{{.Path}}' | tail -n 1)) to confirm the removed directive is still present.
6. Trigger reactivation: After a systemd daemon-reload or system reboot, the stale directives (e.g., host mounts, capabilities) are reactivated for any container using that Quadlet.
7. Exploit retained access: If the container image is later updated with an adversarial image (e.g., via a mutable tag pull), the retained host-access mount or capability can be leveraged to read host secrets or modify host files (Red Hat Bugzilla, GitHub Issue).

• File System: Installed Quadlet unit files (typically under ~/.config/containers/systemd/ for rootless or /etc/containers/systemd/ for root) containing directives not present in the source Quadlet used for replacement; file size of the installed Quadlet larger than the source replacement file.
• Logs: Absence of any error or warning in Podman output after podman quadlet install --replace when the replacement file is shorter than the original; systemd journal entries showing unexpected capabilities or volume mounts activated for a container after a daemon-reload.
• Process/Runtime: Containers running with capabilities (e.g., SYS_ADMIN, NET_ADMIN) or host volume mounts that were not present in the current source Quadlet file, detectable via podman inspect <container> reviewing HostConfig.CapAdd and HostConfig.Binds.

Patches are available at commit a38a9b7 for Podman v5.8.6 and v6.0.0; administrators should upgrade to these versions. If patching is not immediately possible, two workarounds are available: (1) manually copy Quadlet files directly to the Quadlet directory instead of using podman quadlet install --replace, or (2) manually delete the destination file before running podman quadlet install (without the --replace flag). After any replacement operation on unpatched systems, administrators should verify installed unit file contents match the intended source file (Red Hat Advisory, GitHub Advisory).

The vulnerability was discovered and reported by Christopher Lusk of North Echo Security Research, with the CVSS scoring subject to a notable discussion: the reporter initially scored it 7.5 (Scope Changed), while Podman upstream maintainer Paul Holzinger argued for Scope Unchanged (4.2), reasoning that the flaw does not independently grant new capabilities beyond what the administrator already controls — a position Red Hat adopted (Red Hat Advisory). The issue was first publicly surfaced as a bug report on GitHub by a community user in June 2026, before being escalated to a security advisory (GitHub Issue). Coverage has been limited to security aggregators, vulnerability databases, and self-hosted software newsletters, reflecting the moderate severity and narrow exploitation conditions (Feedly).