Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-121885— Podman: untrusted image labels allow auto-update to restart arbitrary systemd units

Quick assessment

Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Podman 中发现了一个安全漏洞。攻击者可通过提供包含恶意构造元数据标签的容器镜像，触发拒绝服务（DoS）攻击。Podman 的自动更新机制错误地信任这些镜像标签，并据此决定需要重启哪些系统服务。如果用户运行了恶意容器且自动更新进程对其进行处理，则以该用户权限重启任意系统服务；当 Podman 以管理员权限运行时，攻击者可能借此关闭宿主系统。

CVSS 6.5 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-121885

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Podman: untrusted image labels allow auto-update to restart arbitrary systemd units
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in Podman. An attacker can trigger a Denial of Service (DoS) by supplying a container image containing crafted metadata labels. Podman's auto-update mechanism improperly trusts these image labels to determine which system services to restart. If a user runs the malicious container and auto-update processes it, arbitrary system services are restarted with the user's privileges, potentially allowing an attacker to shut down the host system when Podman runs with administrative privileges.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在安全决策中依赖未经信任的输入
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Enterprise Linux 10 - cpe:/a:redhat:enterprise_linux:10
Red Hat Red Hat Enterprise Linux 8 - cpe:/a:redhat:enterprise_linux:8
Red Hat Red Hat Enterprise Linux 9 - cpe:/a:redhat:enterprise_linux:9
Red Hat Red Hat Hardened Images - cpe:/a:redhat:hummingbird:1
Red Hat Red Hat OpenShift Container Platform 4 - cpe:/a:redhat:openshift:4

II. Public POCs for CVE-2026-121885

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-121885

请登录查看更多情报信息。

Other References for CVE-2026-121885 (2)

Same Patch Batch · Red Hat · 2026-11-10 · 11 CVEs total

CVE-2026-120399 7.5 HIGH Flightctl-api: flightctl-remote-access: flightctl: unbounded tls handshake in conncontext
CVE-2026-124747 7.5 HIGH Busybox: heap buffer overflow in wget ftp resume when the resume offset exceeds the report
CVE-2026-125712 7.5 HIGH Gst-plugins-base: gst-plugins-base: missing bounds checks in rtcp sdes packet parsing
CVE-2026-125704 7.5 HIGH Gstreamer: gstreamer: use-after-free in gstreamer core buffer value deserialization
CVE-2026-125652 6.8 MEDIUM Keycloak-services: keycloak-services: client-level mandatory pkce bypass via login-actions
CVE-2026-125672 6.6 MEDIUM Cockpit: cockpit-storaged: tang keyserver address from an untrusted luks header clevis tok
CVE-2026-125707 6.1 MEDIUM Gst-plugins-bad: gst-plugins-bad: off-by-one write in mxf demuxer temporal offset table
CVE-2026-125706 5.5 MEDIUM Gst-plugins-bad: gst-plugins-bad: missing bounds checks in mpeg ps pes header parsing
CVE-2026-125703 5.5 MEDIUM Gst-plugins-bad: gst-plugins-bad: bounds check errors in mxf vanc packet handling
CVE-2026-125709 4.2 MEDIUM Libstdc++: overflow leaves streambuf in inconsistent state on i/o error.

IV. Related Vulnerabilities

Same product: Red Hat Enterprise Linux 10
Same vendor: Red Hat
Same weakness: CWE-807