{"vulnerability": "CVE-2026-57231", "sightings": [{"uuid": "51cc6116-d635-43b2-a75f-c72aebc9ce88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57231", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp7lwuwflj26", "content": "CVE-2026-57231 - Podman: Malformed Image can trick podman run into leaking host environment variables into the container\nCVE ID : CVE-2026-57231\n \n Published : June 26, 2026, 4:29 p.m. | 1\u00a0hour, 16\u00a0minutes ago\n \n Description : Podman is a tool for managing OCI containers and p...", "creation_timestamp": "2026-06-26T18:42:49.292086Z"}, {"uuid": "67652e57-6e0a-419e-a6f2-e37bef6eef66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57231", "type": "seen", "source": "https://bsky.app/profile/canartuc.com/post/3mpbbr7oncd2v", "content": "Podman 5.8.4 patches CVE-2026-57231, where a crafted image with malformed Env entries could leak host environment variables into the container, including via glob patterns. It also bumps x/crypto for two more CVEs. Do you treat image Env as untrusted?\n#containers", "creation_timestamp": "2026-06-27T10:46:02.027782Z"}, {"uuid": "02e08717-4267-4231-8829-94e7d901b837", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57231", "type": "seen", "source": "https://bsky.app/profile/mfahlandt.bsky.social/post/3mpgh5trego2s", "content": "\ud83d\udee1\ufe0f LWCN Week 27: Strimzi 1.1.0 removes older CRD APIs.\n*   Strimzi Kafka Operator 1.1.0 removes support for v1beta2, v1beta1, v1alpha1 CRD APIs.\n*   Podman v6.0.0/v5.8.4 addressed CVE-2026-57231 (host env var leak).\n*   Envoy patch releases resolved CVE-20\u2026\n\nhttps://lwcn.dev/newsletter/2026-week-27/", "creation_timestamp": "2026-06-29T12:05:52.529616Z"}, {"uuid": "dcad79d8-ace4-4082-b361-5f59c8e4e713", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57231", "type": "seen", "source": "https://bsky.app/profile/newsarea.bsky.social/post/3mprigfrrpl2x", "content": "Podman 6.0 Cuts Five Legacy Layers: What Container Teams Must Audit Before\u00a0Upgrading\n\nPodman 6.0 removes cgroups v1, iptables, CNI, slirp4netns, and BoltDB permanently, and patches CVE-2026-57231 \u2014 a supply-chain flaw exposing host secrets to malicious container images. Teams on RHEL 8 or custom\u2026", "creation_timestamp": "2026-07-03T21:27:51.594702Z"}, {"uuid": "8e975243-7428-449e-996b-bcd54202340d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-57231", "type": "seen", "source": "https://gist.github.com/alon710/1c4b6cbb0ddd0180b37c1412f848c33e", "content": "# CVE-2026-57231: CVE-2026-57231: Podman Malformed Image Host Environment Variable Leak\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-57231\n\n## Summary\nCVE-2026-57231 is a high-severity vulnerability in the Podman container engine. When executing a container from a crafted OCI or Docker image, malformed environment variable entries lacking an equals separator can trigger an unexpected behavior in the spec generation parser. This vulnerability enables a container image to silently exfiltrate host environment variables into the running container workspace, exposing high-privilege credentials and sensitive runtime secrets.\n\n## TL;DR\nA design flaw in Podman's environment variable parser allows malicious container images containing malformed environment configurations to silently import and exfiltrate host shell environment variables, including wildcards, compromising sensitive credentials.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-200, CWE-668\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: 0.00437\n- **Impact**: Confidentiality (High)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Rocky Linux\n- Alma Linux\n- Alibaba Cloud Linux\n- Red Hat Enterprise Linux CoreOS (RHCOS)\n- Red Hat Enterprise Linux\n- openSUSE\n- Oracle Linux\n- Photon OS\n- **podman**: >= 1.8.1, < 5.8.4 (Fixed in: `5.8.4`)\n- **podman**: >= 6.0.0-alpha, < 6.0.0 (Fixed in: `6.0.0`)\n\n## Mitigation\n\n- Upgrade Podman to secure releases (5.8.4+ or 6.0.0+)\n- Enforce strict image pull policies to only permit verified, signed images from trusted internal registries\n- Sanitize shell sessions in sensitive CI/CD runners to prevent long-lived credentials from persisting in execution environments\n- Regularly audit local image storage for environment configurations lacking '=' characters\n\n**Remediation Steps:**\n1. Identify all hosts running Podman versions >= 1.8.1 and < 5.8.4.\n2. Update Podman packages via the local package manager (e.g., 'dnf update podman' or 'apt-get install podman').\n3. Verify the installed version is 5.8.4, 6.0.0, or newer using 'podman --version'.\n4. Implement registry validation tools to detect images with invalid OCI config specifications.\n5. Inspect running environments for potential exposure using auditing commands.\n\n## References\n\n- [CVE-2026-57231 Record](https://www.cve.org/CVERecord?id=CVE-2026-57231)\n- [GitHub Security Advisory GHSA-4hq8-gpf5-8p68](https://github.com/podman-container-tools/podman/security/advisories/GHSA-4hq8-gpf5-8p68)\n- [Podman Fix Commit](https://github.com/podman-container-tools/podman/commit/6c431b73dbf8e4b20b778644d7a80caebdb75050)\n- [Wiz Vulnerability Analysis Portal](https://www.wiz.io/vulnerability-database/cve/cve-2026-57231)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-57231) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T10:30:33.000000Z"}]}