## Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation

- 種別: advisory
- 重大度: critical
- 関連技術: go, github
- CVE: CVE-2026-94603
- 公開日時: 2026-10-15T20:22:16.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-2cvf-wqm6-wr9g)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-2cvf-wqm6-wr9g

影響: go:github.com/containers/podman >= 4.4.0, < 5.8.8 → 5.8.8, go:go.podman.io/podman/v6 >= 6.0.0, < 6.1.3 → 6.1.3
Impact Podman v4.4.0 added a feature where container checkpoints (from the podman container checkpoint command) could be distributed via OCI registry, and pulled from that registry and run via the podman run command. This allowed easy transfer of checkpoints between systems. However, checkpoints allow complete control of how the container is created - including full control of the container sandbox. When podman run detects a checkpoint, it will silently ignore all user input regarding how the c…