The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but omits O_TRUNC. When the initial reflink copy attempt fails (common on non-reflink-capable filesystems including many RHEL default XFS configurations), the fallback in ReflinkOrCopy uses io.Copy which performs a non-truncating write. If the original Quadlet is larger than the new Quadlet, the file is not truncated and content from the original is preserved. The command completes with no warning. There is no risk of information leakage as the user already had access to the Quadlet in order to replace it, and in most cases, this would only lead to invalid Quadlet files. However, security-related options from the end of the old Quadlet could be included in the new Quadlet, and if the truncation resulted in a valid Quadlet file, this could result in undesirable behavior. For example, running podman quadlet install --replace to remove a single line from the end of a Quadlet - including security-sensitive content, like AddCapability - will fail, and the option will continue to be used. Further, with Volume Quadlets, this can include additional mounts which can cause content to be unintentionally exposed into containers. If, later, the image is updated then compromised content might be leaked to an attacker. The vulnerable code paths are in pkg/domain/infra/abi/quadlet.go (lines 338-360, O_CREATE|O_WRONLY without O_TRUNC) and vendor/go.podman.io/storage/pkg/fileutils/reflink_linux.go (lines 12-19, non-truncating io.Copy fallback).

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1908:10 advisory.

    * podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
      * podman: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)
      * podman: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
      * podman: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
      * podman: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
      * podman: Quadlet install --replace non-truncating write retains removed host-access directives     (CVE-2026-19730)
      * podman: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses     (CVE-2026-39830)
      * podman: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service     (CVE-2026-56853)
      * podman: moby/go-archive: Arbitrary file write via link following in tar extraction (CVE-2026-17106)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69961 advisory.

    * podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

    * podman: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

    * podman: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)

    * podman: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

    * podman: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

    * podman: Quadlet install --replace non-truncating write retains removed host-access directives     (CVE-2026-19730)

    * podman: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses     (CVE-2026-39830)

    * podman: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

    * podman: moby/go-archive: Arbitrary file write via link following in tar extraction (CVE-2026-17106)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:70201 advisory.

    * podman: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application     (CVE-2026-33810)

    * podman: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

    * podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

    * podman: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

    * podman: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)

    * podman: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

    * podman: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

    * podman: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852)

    * podman: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)

    * podman: Quadlet install --replace non-truncating write retains removed host-access directives     (CVE-2026-19730)

    * podman: moby/go-archive: Arbitrary file write via link following in tar extraction (CVE-2026-17106)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-69961 advisory.

    - rebuild with golang-1.26.7 fixing CVE-2026-33818 CVE-2026-56860       CVE-2026-56859 CVE-2026-56858 CVE-2026-56862 CVE-2026-56853       CVE-2026-19730 CVE-2026-39830 CVE-2026-17106

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-70201 advisory.

    - bump golang.org/x/text to v0.39.0 to fix CVE-2026-56852 - Resolves:
      RHEL-250818
    - rebuild for CVE-2026-33810

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:70201 advisory.

    * podman: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application     (CVE-2026-33810)
      * podman: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service     (CVE-2026-56853)
      * podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
      * podman: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)
      * podman: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
      * podman: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
      * podman: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
      * podman: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852)
      * podman: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)
      * podman: Quadlet install --replace non-truncating write retains removed host-access directives     (CVE-2026-19730)
      * podman: moby/go-archive: Arbitrary file write via link following in tar extraction (CVE-2026-17106)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:69961 advisory.

    * podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
      * podman: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)
      * podman: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
      * podman: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
      * podman: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
      * podman: Quadlet install --replace non-truncating write retains removed host-access directives     (CVE-2026-19730)
      * podman: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses     (CVE-2026-39830)
      * podman: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service     (CVE-2026-56853)
      * podman: moby/go-archive: Arbitrary file write via link following in tar extraction (CVE-2026-17106)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69961 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fix(es):

    * podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

    * podman: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

    * podman: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)

    * podman: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

    * podman: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

    * podman: Quadlet install --replace non-truncating write retains removed host-access directives     (CVE-2026-19730)

    * podman: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses     (CVE-2026-39830)

    * podman: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

    * podman: moby/go-archive: Arbitrary file write via link following in tar extraction (CVE-2026-17106)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70201 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fix(es):

    * podman: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application     (CVE-2026-33810)

    * podman: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

    * podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

    * podman: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

    * podman: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)

    * podman: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

    * podman: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

    * podman: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852)

    * podman: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)

    * podman: Quadlet install --replace non-truncating write retains removed host-access directives     (CVE-2026-19730)

    * podman: moby/go-archive: Arbitrary file write via link following in tar extraction (CVE-2026-17106)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 01c15468-9b7b-11f1-a75c-589cfc10a551 advisory.

    The Podman developers report:
    When running podman quadlet install --replace to replace a                Quadlet file, if the original Quadlet is larger than the new                Quadlet, the file would not be truncated and content from the                original would be preserved.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY     but omits O_TRUNC. When the initial reflink copy attempt fails (common on non-reflink-capable filesystems     including many RHEL default XFS configurations), the fallback in ReflinkOrCopy uses io.Copy which performs     a non-truncating write. If the original Quadlet is larger than the new Quadlet, the file is not truncated     and content from the original is preserved. The command completes with no warning. There is no risk of     information leakage as the user already had access to the Quadlet in order to replace it, and in most     cases, this would only lead to invalid Quadlet files. However, security-related options from the end of     the old Quadlet could be included in the new Quadlet, and if the truncation resulted in a valid Quadlet     file, this could result in undesirable behavior. For example, running podman quadlet install --replace to     remove a single line from the end of a Quadlet - including security-sensitive content, like AddCapability
    - will fail, and the option will continue to be used. Further, with Volume Quadlets, this can include     additional mounts which can cause content to be unintentionally exposed into containers. If, later, the     image is updated then compromised content might be leaked to an attacker. The vulnerable code paths are in     pkg/domain/infra/abi/quadlet.go (lines 338-360, O_CREATE|O_WRONLY without O_TRUNC) and     vendor/go.podman.io/storage/pkg/fileutils/reflink_linux.go (lines 12-19, non-truncating io.Copy fallback).
    (CVE-2026-19730)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
349730	MiracleLinux 9 : podman-5.8.2-7.el9_8 (AXSA:2026-1908:10)	Nessus	Miracle Linux Local Security Checks	Local	high
349528	RockyLinux 9 : podman (RLSA-2026:69961)	Nessus	Rocky Linux Local Security Checks	Local	high
349523	RockyLinux 10 : podman (RLSA-2026:70201)	Nessus	Rocky Linux Local Security Checks	Local	high
349494	Oracle Linux 9 : podman (ELSA-2026-69961)	Nessus	Oracle Linux Local Security Checks	Local	high
349490	Oracle Linux 10 : podman (ELSA-2026-70201)	Nessus	Oracle Linux Local Security Checks	Local	high
349482	AlmaLinux 10 : podman (ALSA-2026:70201)	Nessus	Alma Linux Local Security Checks	Local	high
349480	AlmaLinux 9 : podman (ALSA-2026:69961)	Nessus	Alma Linux Local Security Checks	Local	high
349104	RHEL 9 : podman (RHSA-2026:69961)	Nessus	Red Hat Local Security Checks	Local	high
348799	RHEL 10 : podman (RHSA-2026:70201)	Nessus	Red Hat Local Security Checks	Local	high
338014	FreeBSD : podman -- podman quadlet install --replace does not fully replace the old file (01c15468-9b7b-11f1-a75c-589cfc10a551)	Nessus	FreeBSD Local Security Checks	Local	medium
335233	Linux Distros Unpatched Vulnerability : CVE-2026-19730	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-19730

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

medium

medium