CVE-2026-24835: 
Linux Red Hat vulnerability analysis and mitigation

CVE-2026-24835 is a critical authentication bypass vulnerability in Podman Desktop's extension system, classified under CWE-285 (Improper Authorization). It affects all versions of Podman Desktop prior to 1.25.1, where the isAccessAllowed() function unconditionally returns true, allowing any installed extension to bypass permission checks and access all authentication sessions without authorization. The vulnerability was published on January 28, 2026, with a patch released in version 1.25.1. It carries a CVSS v3.1 base score of 7.1 (High) and a CVSS v4.0 base score of 8.8 (High) (GitHub Advisory).

The root cause is an incomplete placeholder implementation in packages/main/src/plugin/authentication.ts (lines 267–287), where the isAccessAllowed(_providerId, _accountName, _extensionId) method contains only return true; // To be implemented later, with no actual permission validation logic, role verification, or audit logging. This function is invoked by the getSession() method (lines 305–313) to determine whether an extension is authorized to access a given authentication provider and account — because it always returns true, any extension unconditionally passes this check. The attack vector is local (an extension must be installed), requires low privileges, and no user interaction, making it straightforward to exploit once a malicious extension is present (GitHub Advisory).

Successful exploitation allows any installed extension — including malicious or compromised ones — to impersonate any user, hijack authentication sessions, and access credentials for connected services such as Docker Hub, Quay.io, GitHub, GitLab, and Kubernetes clusters. This breaks extension isolation entirely, enabling cross-extension data breaches, privilege escalation to administrative registry access, and potential compromise of CI/CD pipelines and multi-tenant container environments. The vulnerability also represents a supply chain attack vector, as a compromised extension published to a public repository could silently harvest authentication tokens from all users who install it (GitHub Advisory).

1. Prepare a malicious extension: Create or modify a Podman Desktop extension (e.g., a package.json manifest and extension.js) that calls the getSession() API for target authentication providers such as Docker Hub, GitHub, or Quay.io.
2. Install the extension: Convince the target user to install the malicious extension via Podman Desktop's Settings → Extensions → Load extension from folder, or distribute it through a public extension repository.
3. Trigger authentication session access: Upon activation, the extension calls getSession(providerId, scopes, options) for each desired provider. The isAccessAllowed() function is invoked internally and unconditionally returns true, granting the extension access to all active authentication sessions.
4. Harvest credentials: The extension receives valid authentication session objects containing tokens and account labels for all connected services (container registries, Git providers, Kubernetes clusters).
5. Exfiltrate or abuse tokens: The harvested tokens can be used to access container registries, pull/push images, access source code repositories, or pivot to cloud infrastructure — all without the user's knowledge (GitHub Advisory).

• File System: Presence of unexpected or unrecognized extension directories under the Podman Desktop extensions folder; extension package.json files referencing authentication-related APIs without a clear legitimate purpose.
• Logs: Podman Desktop application logs showing getSession() calls from extensions that are not expected to require authentication access; repeated authentication provider queries from a single extension across multiple providers.
• Process/Behavior: Extensions activating immediately on startup and querying multiple authentication providers (Docker Hub, GitHub, Quay.io, Kubernetes) in rapid succession; unexpected outbound network connections from the Podman Desktop process to external endpoints shortly after extension installation.
• Network: Outbound HTTP/HTTPS requests to container registry APIs or Git provider APIs originating from Podman Desktop at unusual times or frequencies, potentially indicating token use by a malicious extension (GitHub Advisory).

Upgrade Podman Desktop to version 1.25.1 or later, which contains the patch correcting the isAccessAllowed() implementation. As an interim measure, restrict extension installation to trusted administrators only and audit all currently installed extensions for unexpected authentication API usage. Avoid installing extensions from untrusted or unverified sources until the upgrade is applied (GitHub Advisory).

The vulnerability was reported by researchers b0b0haha, moyushui, and j311yl0v3u and published via GitHub's security advisory system. A brief post appeared on Bluesky shortly after disclosure, and the vulnerability was covered by infinitsec.net with a dedicated write-up on the Podman Desktop extension system's authentication bypass. No major vendor statements beyond the official GitHub advisory have been issued at this time (GitHub Advisory, Infinitsec).