{"vulnerability": "ghsa-fx76-2j3w-2mx6", "sightings": [{"uuid": "7c449e4d-f029-41e8-b5ed-9248ab2c44d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-fx76-2j3w-2mx6", "type": "seen", "source": "https://gist.github.com/alon710/d50e2ea115088fc75fbdb4a4d8d12c2c", "content": "# CVE-2026-19730: CVE-2026-19730: Podman Quadlet Install Non-Truncating Write Retains Removed Host-Access/Security Directives\n\n> **CVSS Score:** 4.2\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-19730\n\n## Summary\nCVE-2026-19730 is a local security vulnerability in the Podman container engine's Quadlet systemd generator. When updating existing configurations using 'podman quadlet install --replace' on filesystems that do not support reflink operations (such as standard ext4), the file is opened without the O_TRUNC flag. If the new configuration file is shorter than the pre-existing file, the trailing lines of the old file remain intact and are successfully parsed by systemd, leading to a failure to remove security-critical parameters like AddCapability, User, or host storage mounts.\n\n## TL;DR\nAn oversight in Podman's configuration-overwriting mechanism fails to truncate files on standard filesystems. When an administrator attempts to reduce container privileges or remove volume mounts by installing a shorter configuration file, the old security-critical lines remain at the end of the file and are still parsed, causing the privileges to persist silently.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-459 (Incomplete Cleanup)\n- **Attack Vector**: Local (AV:L)\n- **CVSS v3.1 Score**: 4.2 (Medium)\n- **EPSS Score**: 0.00163 (Percentile: 4.85%)\n- **Impact Type**: Security Bypass / Privilege Persistence\n- **Exploit Status**: Proof-of-Concept Available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Red Hat Enterprise Linux 9 (podman package prior to 6:5.8.2-7.el9_8)\n- Red Hat Enterprise Linux 10 (podman package prior to 7:5.8.2-9.el10_2)\n- Upstream Podman installations using Quadlet features on ext4 filesystems\n- **Podman**: < 5.8.6 (Fixed in: `5.8.6`)\n- **Podman**: >= 5.9.0, < 6.0.0 (Fixed in: `6.0.0`)\n\n## Mitigation\n\n- Upgrade Podman to version 5.8.6, 6.0.0, or newer to obtain the atomic file creation fix.\n- Manually delete target Quadlet configuration files before running install commands rather than using --replace.\n- Adopt copy-on-write (reflink) supporting filesystems like Btrfs or modern XFS for host deployments.\n- Implement file integrity monitoring and validation scripts to scan systemd configuration directories for stale directives.\n\n**Remediation Steps:**\n1. Identify all managed systems running vulnerable Podman versions (under 5.8.6 / 6.0.0).\n2. Run 'dnf update podman' or 'apt-get install --only-upgrade podman' depending on the underlying OS distribution to apply the patch.\n3. If packages are locked or delayed, modify deployment and configuration pipelines to remove target Quadlets before running replacement commands.\n4. Perform a system-wide systemd daemon reload ('systemctl daemon-reload') to ensure clean config files are reloaded.\n\n## References\n\n- [Red Hat CVE Portal for CVE-2026-19730](https://access.redhat.com/security/cve/CVE-2026-19730)\n- [GitHub Security Advisory GHSA-fx76-2j3w-2mx6](https://github.com/podman-container-tools/podman/security/advisories/GHSA-fx76-2j3w-2mx6)\n- [Red Hat Bugzilla Bug #2508234](https://bugzilla.redhat.com/show_bug.cgi?id=2508234)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-19730) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-24T18:30:33.000000Z"}]}