Loading story…
Red Hat disclosed and patched CVE-2026-39822, an Important vulnerability in Go's os.Root handling on Unix systems that can improperly follow a symbolic link outside the intended root boundary, enabling directory traversal. The flaw is triggered when the final path component is a symlink and the supplied path ends with a trailing slash, such as root.Open("symlink/"), and Red Hat said fixes were prepared across multiple Red Hat Enterprise Linux releases, including RHEL 8, RHEL 9, RHEL 10, and Extended Update Support variants.
Red Hat published July advisories covering affected container tooling, including RHSA-2026:38878 for podman on RHEL 9 and RHSA-2026:38493 and RHSA-2026:38494 for buildah on RHEL 9 and RHEL 10. The updates deliver patched packages including podman 5.8.2-5.el9_8 and buildah 1.43.1-4.el9_8 and 1.43.1-4.el10_2, with fixes released for multiple architectures and support channels such as x86_64, s390x, ppc64le, and aarch64.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important advisory RHSA-2026:57361 for RHEL CoreOS 4 systems running OpenShift Container Platform 4.22.11. The update addresses CVE-2026-39822 as well as the CRI-O HOME-variable /etc/passwd injection bypass CVE-2026-15809 and Go MIME denial-of-service flaw CVE-2026-42504.
Red Hat issued Important advisory RHSA-2026:38878 for podman on Red Hat Enterprise Linux 9 to remediate CVE-2026-39822. The update released podman version 5.8.2-5.el9_8 for several RHEL 9 variants and architectures.
Red Hat issued Important advisory RHSA-2026:38494 for buildah on Red Hat Enterprise Linux 10 addressing CVE-2026-39822. The advisory released buildah version 1.43.1-4.el10_2 for multiple RHEL 10 support channels and architectures.
Red Hat issued Important advisory RHSA-2026:38493 for buildah on Red Hat Enterprise Linux 9 to fix CVE-2026-39822. The update shipped buildah version 1.43.1-4.el9_8 across multiple RHEL 9 variants and architectures.
The Go os.Root symlink-following directory traversal issue was recorded by OSIDB Bzimport in Bugzilla as issue 2498152. The entry describes a Unix flaw where a trailing slash on a symlink path can escape the intended root boundary.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released multiple **Important** security updates for **Podman** across Red Hat Enterprise Linux 9 and 10 product streams after identifying vulnerabilities inherited from bundled or dependent Go components. The advisories cover RHEL 9, RHEL 9.4 support channels, RHEL 10.0 Extended Update Support, and RHEL 10, with fixed builds including `podman-5.6.0-14.el9_7`, `podman-4.9.4-20.el9_4.2`, `podman-5.4.0-15.el10_0.1`, and `podman-5.8.2-1.el10_2` for x86_64, s390x, ppc64le, and aarch64 systems. Red Hat said the issues could lead to denial of service, excessive CPU consumption, memory exhaustion, incorrect URL or IPv6 host parsing, and improper TLS session resumption certificate validation. One of the highlighted flaws, **`CVE-2026-34986`**, affects **go-jose** v3 and v4 and can cause a panic when a crafted JSON Web Encryption object is decrypted with certain key-wrapping algorithms and an empty `encrypted_key` field. Red Hat linked that bug to Podman updates for RHEL 10 streams alongside **`CVE-2026-25679`**, an IPv6 host literal parsing issue in Go's `net/url` package, while earlier Podman advisories addressed related Go vulnerabilities such as `CVE-2025-61729`, `CVE-2025-61728`, `CVE-2025-61726`, and `CVE-2025-68121`. The fixes align with upstream go-jose releases **3.0.5** and **4.1.4**, which remediate the JWE-triggered denial-of-service condition.
Aug 20, 2026
Red Hat released Important security updates for Red Hat OpenShift Container Platform and RHEL 9 Podman and Buildah deployments to remediate container-stack vulnerabilities, notably **CVE-2024-9675** and **CVE-2024-9676**. CVE-2024-9675 can permit arbitrary directory mounts through Buildah, while CVE-2024-9676 is a `containers/storage` symlink-traversal flaw affecting Podman, Buildah, and CRI-O. When a malicious image runs with automatically assigned user namespaces, the latter can cause container creation to block indefinitely or CRI-O to exhaust memory and crash; limited error-message disclosure is also possible to the user operating the affected software. Affected OpenShift releases include 4.12, 4.13, 4.14, 4.15, 4.16, 4.17, and 4.18, with related advisories also addressing flaws such as Dockerfile bind-propagation validation, FIPS crypto-policy mounting, Distribution JWT signing-key injection, and denial-of-service issues in Go, BIND, libxml2, GRUB2, and the Linux kernel. Red Hat advises OpenShift customers to update clusters through their supported release channels using the CLI or web console, and RHEL 9 users to deploy the updated Podman or Buildah packages for their supported architecture and subscription channel.
Aug 26, 2026
Red Hat released multiple security advisories for **RHEL 8.8** and **RHEL 9** container tooling to remediate vulnerabilities in `runc`, `buildah`, `podman`, `skopeo`, and related packages. The most serious issues were three `runc` flaws—`CVE-2025-31133`, `CVE-2025-52565`, and `CVE-2025-52881`—that can enable **container escape** or denial of service through masked path abuse, `/dev/console` mount race conditions, and arbitrary write gadgets using `procfs` write redirects. Red Hat rated several of the updates **Important**, including advisories affecting RHEL 9.0 SAP Solutions, RHEL 9.2 channels, RHEL 9.4 channels, and broader RHEL 9 package streams. The updates also addressed additional bundled-component flaws, including `CVE-2025-58183` in Go's `archive/tar` package, which can trigger unbounded memory allocation when parsing a GNU sparse map; `CVE-2025-47913` in `golang.org/x/crypto/ssh/agent`, which can cause a panic; and `CVE-2025-65637` in `github.com/sirupsen/logrus`, a denial-of-service issue. Fixed package versions published across the advisories include `runc 1.2.9-1.el9_2.1`, `buildah 1.29.5-1.el9_2.2`, `buildah 1.33.13-2.el9_4.1`, `buildah 1.41.6-1.el9_7`, and updated RHEL 9.0 SAP Solutions builds for `buildah`, `crun`, `podman`, `runc`, and `skopeo`; Red Hat also shipped a **Moderate** update for the `container-tools:rhel8` module to fix the Go `archive/tar` and `logrus` issues.
Aug 20, 2026