Bug 2569675

Summary: CVE-2026-121885 podman: Untrusted image labels allow auto-update to restart arbitrary systemd units [fedora-all]
Product: [Fedora] Fedora Reporter: Vladimir Vasilev <vvasilev>
Component: podmanAssignee: Jan Kaluža <jkaluza>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: bbaude, debarshir, dwalsh, go-sig, jkaluza, jnovy, mboddu, mheon, nicola.sella, patrick, pholzing, rruzicka, suraj.ghimire7, vmiticka
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["4a15b012-374d-4f7b-a8c9-fbe49d6816f5"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2566844    

Description Vladimir Vasilev 2026-11-10 14:00:37 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in Podman's auto-update functionality in versions 1.8.2 through 6.1.4. Podman copies image labels into containers, and auto-update trusts the io.containers.autoupdate and PODMAN_SYSTEMD_UNIT labels to determine whether a container should be updated and which systemd unit to restart. An attacker can supply a container image with crafted labels that, when run by a user and subsequently processed by auto-update, causes arbitrary systemd units to be restarted with that user's privileges. When Podman runs as root, targeting poweroff.target may shut down the host, resulting in a complete loss of availability.