A flaw in Podman’s container runtime allows a malicious image that carries the io.podman.annotations.checkpoint.runtime.name annotation to be treated as a restored checkpoint, silently bypassing user‑supplied creation restrictions such as --cap-drop=ALL. This issue is an example of improper confinement (CWE-15) and insecure default configuration (CWE-693). When such an image is launched with podman run, the container inherits weaker sandbox settings and elevated capabilities, potentially granting host‑level privileges to the attacker’s code. Rootless containers are not affected because checkpoint and restore are unavailable in that mode.

Podman, the container runtime from podman-container-tools, in versions 4.4.0 through 5.8.7 and 6.1.0 through 6.1.2, is affected. The issue is fixed in releases 5.8.8 and 6.1.3.

The CVSS score of 10 classifies this flaw as critical. The EPSS score is not available, and it is not listed in the CISA KEV catalog, suggesting it may not yet be widely exploited. The likely attack vector is simple: an attacker can supply a crafted image containing the checkpoint annotation, and a user who runs that image can unknowingly compromise the host. The risk of exploitation remains high in environments where containers are run with root privileges; rootless containers remain unaffected.