{"cve":"CVE-2026-19730","nvd":{"published":"2026-08-13T18:17:25.330","modified":"2026-10-01T18:17:17.550","status":"Awaiting Analysis","description":"The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but omits O_TRUNC. When the initial reflink copy attempt fails (common on non-reflink-capable filesystems including many RHEL default XFS configurations), the fallback in ReflinkOrCopy uses io.Copy which performs a non-truncating write. If the original Quadlet is larger than the new Quadlet, the file is not truncated and content from the original is preserved. The command completes with no warning.\n\nThere is no risk of information leakage as the user already had access to the Quadlet in order to replace it, and in most cases, this would only lead to invalid Quadlet files. However, security-related options from the end of the old Quadlet could be included in the new Quadlet, and if the truncation resulted in a valid Quadlet file, this could result in undesirable behavior. For example, running podman quadlet install --replace to remove a single line from the end of a Quadlet - including security-sensitive content, like AddCapability - will fail, and the option will continue to be used. Further, with Volume Quadlets, this can include additional mounts which can cause content to be unintentionally exposed into containers. If, later, the image is updated then compromised content might be leaked to an attacker.\n\nThe vulnerable code paths are in pkg/domain/infra/abi/quadlet.go (lines 338-360, O_CREATE|O_WRONLY without O_TRUNC) and vendor/go.podman.io/storage/pkg/fileutils/reflink_linux.go (lines 12-19, non-truncating io.Copy fallback).","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","score":4.2},"cwes":["CWE-459"],"references":["https://access.redhat.com/errata/RHSA-2026:69961","https://access.redhat.com/errata/RHSA-2026:70201","https://access.redhat.com/security/cve/CVE-2026-19730","https://bugzilla.redhat.com/show_bug.cgi?id=2508234","https://github.com/podman-container-tools/podman/issues/29013"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:48:17.459049833+00:00"},"epss":{"cve":"CVE-2026-19730","score":0.0013,"percentile":0.02641,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-fx76-2j3w-2mx6","url":"https://osv.dev/vulnerability/GHSA-fx76-2j3w-2mx6","summary":"podman quadlet install --replace does not fully replace the old file","modified":"2026-10-01T20:56:10.614461718Z","packages":[{"ecosystem":"Go","name":"github.com/containers/podman/v5","purl":"pkg:golang/github.com/containers/podman/v5","ranges":[">=5.7.0 <5.8.6"],"fixed":["5.8.6"]}]},{"id":"GO-2026-6588","url":"https://osv.dev/vulnerability/GO-2026-6588","summary":"podman quadlet install --replace does not fully replace the old file in github.com/containers/podman","modified":"2026-10-01T20:45:14.987114752Z","packages":[{"ecosystem":"Go","name":"github.com/containers/podman","purl":"pkg:golang/github.com/containers/podman","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/containers/podman/v2","purl":"pkg:golang/github.com/containers/podman/v2","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/containers/podman/v3","purl":"pkg:golang/github.com/containers/podman/v3","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/containers/podman/v4","purl":"pkg:golang/github.com/containers/podman/v4","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/containers/podman/v5","purl":"pkg:golang/github.com/containers/podman/v5","ranges":[">=5.7.0 <5.8.6"],"fixed":["5.8.6"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}