CVE-2026-55686 Podman: WORKDIR symlink traversal vulnerability
A malicious container image with a symlinked WORKDIR can create directories or modify ownership on the host filesystem, potentially leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55686?
CVE-2026-55686 is a medium-severity path traversal vulnerability in podman-container-tools podman, published on 26 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path contains a symlink can create a directory or modify ownership on the host filesystem. Modified ownership is less likely to happen as that requires help from an untrusted/malicious process that mutates the host filesystem tree during dereferencing of the WORKDIR path, to trigger a race condition. This vulnerability is fixed in 5.7.1.
Weakness: CWE-61
Which versions are affected by CVE-2026-55686?
11 open source packages ship an affected version, including github.com/containers/podman/v3, github.com/containers/podman and github.com/containers/podman/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/containers/podman/v3 Go | All versions | None |
github.com/containers/podman/v3 Go | All versions to 3.4.7 | None |
github.com/containers/podman/v3 Go | All versions to 3.4.7 | None |
github.com/containers/podman Go | All versions | None |
github.com/containers/podman/v2 Go | All versions | None |
github.com/containers/podman/v4 Go | All versions | None |
5 more packages
github.com/containers/podman/v4 Go | All versions to 4.9.5 | None |
github.com/containers/podman/v4 Go | All versions to 4.9.5 | None |
github.com/containers/podman/v5 Go | All versions | 5.7.1 |
github.com/containers/podman/v5 Go | All versions | 5.7.1 |
github.com/containers/podman/v5 Go | All versions | 5.7.1 |
Products include Podman Project Podman.
How do I fix CVE-2026-55686?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-55686 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55686 exists.
Other vulnerabilities in podman-container-tools podman
- CVE-2026-57231 Podman: Malformed Image can trick podman run into leaking host environment variables into the container
- CVE-2022-2738 Use after free in podman
- CVE-2022-2989 Podman's incorrect handling of the supplementary groups may lead to data disclosure, modification
- CVE-2021-20188 Improper Authorization in github.com/containers/libpod
- CVE-2023-0778 Podman Time-of-check Time-of-use (TOCTOU) Race Condition
Sources
Also known as AZL-91299, BELL-CVE-2026-55686, CLSA-2026-1782985538, CLSA-2026-1782987821, DEBIAN-CVE-2026-55686, GHSA-q6r4-3wmg-fwcq and 3 more.