Red Hat issued a security advisory (RHSA-2026:29954) for Red Hat Hardened Images RPMs including Podman 6.0.0-1.hum1 and related packages. The advisory addresses two CVEs: CVE-2026-55686 and CVE-2026-57231. The latter describes a vulnerability where a malicious container image can be crafted with environment variables having keys but no values or an asterisk (*), tricking Podman into passing host environment variables into the container. This results in potential information disclosure of all Podman environment variables from the launching session. The advisory notes no available mitigation meets Red Hat's criteria for ease of use, deployment, or stability, and no fix is currently provided. The packages affected include podman, podman-docker, podman-machine, podman-remote, podman-tests, and podmansh for aarch64 and x86_64 architectures.

The vulnerability allows a malicious container image to exfiltrate host environment variables from the Podman session launching the container, leading to information disclosure. This can expose sensitive environment data to attackers. There is no indication of privilege escalation or code execution from the advisory. No known exploits are reported in the wild.

Currently, no official fix or mitigation meeting Red Hat's criteria is available for this vulnerability. Users are advised to monitor Red Hat advisories for updates. Applying the update to the listed RPMs (version 6.0.0-1.hum1) is recommended once a fix is released. Until then, consider restricting the use of untrusted container images and limit environment variable exposure where possible.