Podman Checkpoint Image Sandbox Bypass: Update Checklist

Quick answer: CVE-2026-94603 is a critical Podman design flaw in which an OCI image carrying the io.podman.annotations.checkpoint.runtime.name annotation could make podman run treat it as a checkpoint. Checkpoints control how a container is recreated, so Podman could silently ignore operator-supplied restrictions such as --cap-drop=ALL and use the checkpoint's more privileged settings instead. The affected upstream ranges are Podman 4.4.0 through 5.8.7 and 6.0.0 through 6.1.2. Podman 5.8.8 and 6.1.3 remove checkpoint-image support from podman run. Rootless containers are not affected according to the maintainer advisory because checkpoint/restore is not supported there, but operators should verify how their workload actually runs rather than infer rootless status from intent.

This is source-based operator analysis published October 19, 2026. WealthLab did not build or run a crafted checkpoint image, test a sandbox escape, inspect a production Podman host, or validate a recovery procedure. This article contains no affiliate links.

Why an image annotation could override the sandbox

Podman added the ability to distribute container checkpoints through OCI registries and launch them with podman run in version 4.4.0. That convenience combined two objects with different trust models. A normal image supplies a filesystem and metadata while the operator's command and policy define the sandbox. A checkpoint represents a previously running container and needs enough state to recreate its execution environment.

The vulnerable path identified checkpoint images by one OCI annotation. When present, Podman restored the checkpoint and disregarded command-line creation controls. The maintainer advisory uses --cap-drop=ALL as its example: the user could request that every Linux capability be dropped, yet a checkpoint could supply a different capability set. The issue is therefore not that annotations are executable by themselves; it is that the annotation selected a restore path whose security configuration took precedence over explicit operator restrictions.

Who should act first?

• Highest priority: rootful Podman hosts where users, CI jobs, automation, or deployment APIs can choose images from outside a tightly controlled registry and repository set.
• High priority: build or test systems that intentionally run third-party images while depending on command-line restrictions such as capability drops, read-only filesystems, user mappings, seccomp, SELinux, or namespace controls.
• High priority: shared hosts where a container receiving unexpected privileges would cross a meaningful tenant, credential, network, device, or data boundary.
• Review carefully: systems that mirror external images into an internal registry. A private registry narrows distribution but does not make imported content trustworthy.
• Lower exposure for this CVE: verified rootless-only environments and rootful hosts that execute only reviewed, provenance-controlled images. They should still update through normal security maintenance.

Running an affected version does not prove that a malicious checkpoint image was executed. Conversely, a hardened-looking podman run command is not sufficient evidence that its requested controls took effect on a vulnerable checkpoint path.

Inventory the effective exposure

1. Record the running Podman version and package source. Capture podman version and the operating-system package version without changing the host. Determine whether the package is upstream, distribution-maintained, or vendor-backported.
2. Distinguish rootful from rootless execution. Check the account, systemd unit, socket, CI runner, remote client target, and automation service that actually launches containers. A developer's rootless shell does not prove a system service is rootless.
3. Map who controls image references. Include Compose or Quadlet files, Kubernetes manifests, CI parameters, webhook inputs, deployment panels, scripts, and any API accepting registry, repository, tag, or digest values.
4. Review image provenance. Identify registries, mirrors, signatures, admission or policy controls, mutable tags, and identities allowed to publish into trusted namespaces.
5. Search retained image metadata safely. The maintainer workaround is to reject images containing io.podman.annotations.checkpoint.runtime.name. Perform metadata inspection without launching uncertain content, and preserve suspicious manifests and digests for investigation.

The upstream advisory says Podman did not provide automatic scanning and rejection for this workaround at disclosure. Red Hat's product page says no mitigation met its criteria for broad ease, applicability, and stability. Those statements are compatible: a targeted registry or pipeline check can reduce exposure, but it is not a substitute for a supported package fix across every deployment.

Safe update checklist

1. Preserve evidence first if needed. If an untrusted or unexplained image ran rootfully, record image references and digests, manifests, creation commands or unit definitions, Podman events and service logs, timestamps, container inspection data, and relevant host audit evidence before cleanup.
2. Back up configuration and application data. Preserve Quadlet units, Compose files, registries and policy configuration, systemd overrides, secrets through their protected backup path, and persistent volumes independently of containers.
3. Choose the supported package. Upstream's first patched releases are 5.8.8 and 6.1.3. Prefer the latest supported security update supplied by the operating system or vendor rather than forcing an upstream binary over managed packages.
4. Identify checkpoint workflows before rollout. The fix intentionally removes checkpoint images from podman run. Teams that transported checkpoints through registries must redesign around an explicit, controlled checkpoint/restore workflow and test it separately.
5. Stage representative workloads. Verify container creation, capability and user settings, bind mounts and volumes, SELinux labels, networking, health checks, restart behavior, Quadlet or systemd integration, and approved image pulls.
6. Update and restart deliberately. Account for service interruption and clustered workload placement. Do not assume replacing a package changes every already-running daemon, socket-activated service, or long-lived automation environment.
7. Read back the result. Re-run version and package checks, create a benign disposable container with expected restrictions, verify production services, and confirm uncertain checkpoint images now fail through podman run as documented.

Temporary controls when patching is delayed

• Stop rootful execution of user-selected or unreviewed images where operationally possible.
• Reject the checkpoint runtime annotation in a trusted registry, admission, or pre-deployment policy before the image reaches podman run. Test that the policy cannot be bypassed through alternate registries, mirrors, tags, or remote Podman services.
• Restrict image sources to approved repositories and immutable digests. Digest pinning preserves identity but does not prove the identified content is safe, so retain publisher and review controls.
• Prefer verified rootless execution for workloads that do not require rootful features, while treating that as one boundary rather than a universal containment guarantee.
• Reduce credentials, devices, host paths, sockets, and network authority available to the Podman service and its callers.
• Monitor newly pulled images, unexpected checkpoint annotations, privileged container state, changes to systemd units, and host security events.

Do not create or run a weaponized checkpoint image in production to confirm exposure. Version, execution mode, image-control paths, metadata, and vendor package status provide safer scoping evidence.

Incident-response decision points

If logs or retained metadata show that an untrusted annotated image ran rootfully on an affected version, treat the host as potentially exposed beyond the restrictions written on the command line. Preserve evidence and determine what the resulting container could reach: host paths, container or Podman sockets, devices, networks, service credentials, cloud metadata, and other workloads.

Credential rotation should follow evidence and reachable authority. Revoke and replace credentials that were accessible to a suspicious container, but do not put replacements back onto a host whose integrity remains uncertain. Rebuild from trusted packages and images when host-level evidence cannot establish a reliable boundary. WealthLab did not validate a forensic or rebuild procedure for this flaw.

Rollback and compatibility boundary

The corrected releases deliberately reject a behavior some checkpoint users may have depended on. Rolling back to restore that behavior also restores the published vulnerability. Prefer redesigning the workflow around explicit checkpoint operations with controlled provenance. If a temporary rollback is unavoidable, isolate image sources and callers, reduce host authority, monitor the exception, document who accepted the risk, and give the exception a short expiry.

A successful package downgrade is not a recovery test. Verify application startup, persistent data, networking, policy enforcement, systemd integration, and the security state that justified the rollback. Do not claim the old checkpoint workflow is safe merely because it works.

What not to conclude

• Do not infer compromise from an affected version alone.
• Do not say every Podman container escaped its sandbox; the published path requires checkpoint-identifying image metadata and podman run on an affected rootful setup.
• Do not equate the CVSS 10.0 score with proof of remote exploitation on a specific host. The attacker still needs an image to be selected and executed through the vulnerable path.
• Do not assume an internal registry, immutable digest, or signed image is benign without controlling who can publish and what was reviewed.
• Do not generalize this Podman issue to Docker or every OCI runtime. The advisory describes Podman's checkpoint-image handling.

Evidence boundary and corroboration

WealthLab compared the Podman maintainer advisory, the 5.8.8 and 6.1.3 release notes, the public fix commits, GitHub's advisory database, and Red Hat Product Security's CVE page. The sources agree that checkpoint metadata could select a restore path that ignored requested sandbox controls and that upstream removed checkpoint-image support from podman run. GitHub records the advisory on October 15, while the fixed upstream releases were published September 29; these are publication dates, not evidence that exploitation occurred between them. Red Hat independently describes the sandbox bypass and operator-triggered untrusted-image prerequisite, while rating its product impact Important rather than reproducing GitHub's critical label. No hands-on reproduction or in-the-wild incident report was used.

Related WealthLab guides

• Docker VPS Production Checklist — apply the same provenance, least-privilege, monitoring, and recovery questions to container hosts.
• Docker Engine 29.9.1 containerd security checklist — a separate image-ingestion risk affecting containerd-based environments.
• VPS Firewall Setup for Docker Apps — map effective ingress and avoid assuming a published port is protected by host defaults.
• Ghost Docker Backup and Restore Guide — recovery evidence, database consistency, and restore validation.

Sources checked October 19, 2026

• Podman maintainer advisory GHSA-2cvf-wqm6-wr9g — vulnerable behavior, affected versions, rootless exception, fixes, workaround, severity, and CVE.
• Podman 5.8.8 release notes — 5.x fix and breaking removal of checkpoint images from podman run.
• Podman 6.1.3 release notes — 6.x fix and the same behavior change.
• Upstream revert commit — maintainer rationale for separating checkpoint restoration from ordinary image execution.
• Red Hat Product Security: CVE-2026-94603 — independent product-context description, Important impact rating, prerequisite, and mitigation assessment.
• GitHub Advisory Database entry — database-level package ranges, first patched versions, identifiers, and publication date.