Search: CVE-2026-94603

Podman versions from 4.4.0 up to but not including 5.8.8, and from 6.0.0 up to but not including 6.1.3, contain a vulnerability where the 'podman run' command treats images with the io.podman.annotations.checkpoint.runtime.name annotation as checkpoints. This causes the tool to ignore user-supplied container creation restrictions such as --cap-drop=ALL, potentially allowing weaker sandbox settings and capabilities. Rootless containers are not affected. The issue is fixed in versions 5.8.8 and 6.1.3.