CVE-2026-19730
Received Received - Intake

Podman Quadlet File Truncation Failure Leading to Unintended Configuration Retention

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Red Hat, Inc.

Description
The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but omits O_TRUNC. When the initial reflink copy attempt fails (common on non-reflink-capable filesystems including many RHEL default XFS configurations), the fallback in ReflinkOrCopy uses io.Copy which performs a non-truncating write. If the original Quadlet is larger than the new Quadlet, the file is not truncated and content from the original is preserved. The command completes with no warning. There is no risk of information leakage as the user already had access to the Quadlet in order to replace it, and in most cases, this would only lead to invalid Quadlet files. However, security-related options from the end of the old Quadlet could be included in the new Quadlet, and if the truncation resulted in a valid Quadlet file, this could result in undesirable behavior. For example, running podman quadlet install --replace to remove a single line from the end of a Quadlet - including security-sensitive content, like AddCapability - will fail, and the option will continue to be used. Further, with Volume Quadlets, this can include additional mounts which can cause content to be unintentionally exposed into containers. If, later, the image is updated then compromised content might be leaked to an attacker. The vulnerable code paths are in pkg/domain/infra/abi/quadlet.go (lines 338-360, O_CREATE|O_WRONLY without O_TRUNC) and vendor/go.podman.io/storage/pkg/fileutils/reflink_linux.go (lines 12-19, non-truncating io.Copy fallback).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-19730
EUVD
EUVD-2026-58187

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
podman podman 5.8.6
podman podman 6.0.0
podman podman From 5.8 (inc) to 5.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-459 The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19730 is a flaw in Podman's quadlet install --replace command where replacing a Quadlet file with a smaller one fails to fully truncate the original file. This leaves remnants of the old file, including security-sensitive options like AddCapability or Volume mounts, which could persist and cause unintended behavior.

Detection Guidance

Check Podman version with 'podman version' to confirm if it is 5.7.0 or later. Inspect Quadlet files in /etc/containers/systemd/ for unexpected leftover content after using 'podman quadlet install --replace' with a smaller file. Compare file sizes before and after replacement to detect truncation failures.

Impact Analysis

The vulnerability could lead to security-sensitive options remaining active after removal attempts, such as AddCapability directives or host-access mounts. This might expose unintended content to containers or allow retained host access if the image is later updated with compromised content.

Mitigation Strategies

Upgrade Podman to version 5.8.6 or 6.0.0 if available. Avoid using 'podman quadlet install --replace' with smaller files. Manually delete the target Quadlet file before reinstalling or verify file contents after replacement. For unpatched versions, use manual file copying instead of replace flag.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19730. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart