Red Hat Security Advisory

RHSA-2026:38878

podman security update

Released 2026-07-13 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) podman-6:5.8.2-5.el9_8, podman-docker-6:5.8.2-5.el9_8, podman-plugins-6:5.8.2-5.el9_8 +2

Fixes 1 record

TI-2026-28704 CVE-2026-39822 · GHSA-xcgv-8mv7-v8c7

Root escape via symlink plus trailing slash in os

LOW 36

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00232 Published 2026-07-08 Partial fix · 1.25.12, 1.26.5 +1 CWE-61