Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk (*) will cause podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all podman environment variables that are set in the session from where the container is launched. This vulnerability is fixed in 5.8.4 and 6.0.0.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1491:07 advisory.

    * golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate     (CVE-2026-39835)
      * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with     excessive parameters (CVE-2026-39829)
      * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling     of key restrictions (CVE-2026-39832)
      * golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via     unchecked SignatureKey (CVE-2026-42508)
      * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass     (CVE-2026-27136)
      * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)
      * podman: Podman: Information disclosure via malicious container image environment variables     (CVE-2026-57231)     Bug Fix(es) and Enhancement(s):
      * podman does not clean up all files and leaves orphaned files consuming disk space [rhel-9.8.z]     (JIRA:RHEL-173988)
      * [FJ9.8 Bug]: [REG]The podman-remote save command fails for rootless users. [rhel-9.8.z]     (JIRA:RHEL-192439)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1348:01 advisory.

    * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
      * golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH     certificate (CVE-2026-39835)
      * podman: Podman: Information disclosure via malicious container image environment variables     (CVE-2026-57231)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-37072 advisory.

    - rebuild for CVE-2026-39822
    - fixes CVE-2026-42508 CVE-2026-39829 CVE-2026-39830 CVE-2026-39832 CVE-2026-39835
    - fixes CVE-2026-57231 CVE-2026-25681 CVE-2026-27136
    - Rebuild for CVE-2026-32283
    - Rebuild for CVE-2026-25679

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0221 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2026-33811:
    When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of     C memory and a crash.

    CVE-2026-39835:
    SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or     IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an     error instead of panicking when these callbacks are nil.

    CVE-2026-57231:
    Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that     contains a environment variable with just a key and no value can trick podman into passing that variable     from the host into the container. This is made worse by the fact that using an asterisk (*) will cause     podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all     podman environment variables that are set in the session from where the container is launched. This     vulnerability is fixed in 5.8.4 and 6.0.0.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0661 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-33811:
    When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of     C memory and a crash.

    CVE-2026-39835:
    SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or     IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an     error instead of panicking when these callbacks are nil.

    CVE-2026-57231:
    Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that     contains a environment variable with just a key and no value can trick podman into passing that variable     from the host into the container. This is made worse by the fact that using an asterisk (*) will cause     podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all     podman environment variables that are set in the session from where the container is launched. This     vulnerability is fixed in 5.8.4 and 6.0.0.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-38504 advisory.

    - bump golang.org/x/crypto to v0.53.0 to fix CVE-2026-39829, CVE-2026-39830, CVE-2026-39832

    cockpit-podman
    - rebuild for CVE-2025-68121
    - update to the latest content of v4.9-rhel (commit bd39e82) to fix CVE-2026-39835, CVE-2026-57231,     CVE-2026-25681, CVE-2026-27136
    - rebuild for CVE-2025-68121
    - Rebuild for CVE-2026-32281

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:38504 advisory.

    * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
      * golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH     certificate (CVE-2026-39835)
      * podman: Podman: Information disclosure via malicious container image environment variables     (CVE-2026-57231)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:37123 advisory.

    * golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate     (CVE-2026-39835)
      * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with     excessive parameters (CVE-2026-39829)
      * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling     of key restrictions (CVE-2026-39832)
      * golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via     unchecked SignatureKey (CVE-2026-42508)
      * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass     (CVE-2026-27136)
      * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)
      * podman: Podman: Information disclosure via malicious container image environment variables     (CVE-2026-57231)


    Bug Fix(es) and Enhancement(s):

      * podman does not clean up all files and leaves orphaned files consuming disk space [almalinux-9.8.z]     (JIRA:AlmaLinux-173988)
      * [FJ9.8 Bug]: [REG]The podman-remote save command fails for rootless users. [almalinux-9.8.z]     (JIRA:AlmaLinux-192439)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:38504 advisory.

    * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

    * golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate     (CVE-2026-39835)

    * podman: Podman: Information disclosure via malicious container image environment variables     (CVE-2026-57231)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:38504 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

    * golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate     (CVE-2026-39835)

    * podman: Podman: Information disclosure via malicious container image environment variables     (CVE-2026-57231)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-37123 advisory.

    [5.8.2-4.0.1]
    - Rework CNI/Netavark detection logic [JIRA: EVG-3769]
    - Rebuild on new golang to support experimental GODEBUG fipsnoenforceems
    - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404]

    [6:5.8.2-4]
    - bump to upstream commit a476c2b2 fixing CVE-2026-39835 CVE-2026-39829       CVE-2026-39832 CVE-2026-42508 CVE-2026-27136 CVE-2026-25681 CVE-2026-57231 and       podman-remote save regression

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:37072 advisory.

    * golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate     (CVE-2026-39835)

    * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with     excessive parameters (CVE-2026-39829)

    * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited     SSH responses (CVE-2026-39830)

    * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling     of key restrictions (CVE-2026-39832)

    * golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via     unchecked SignatureKey (CVE-2026-42508)

    * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass     (CVE-2026-27136)

    * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)

    * podman: Podman: Information disclosure via malicious container image environment variables     (CVE-2026-57231)

    Bug Fix(es) and Enhancement(s):

    * podman does not clean up all files and leaves orphaned files consuming disk space [rhel-10.2.z]     (JIRA:Rocky Linux-173842)

    * [FJ10.2 Bug]: [REG]The podman-remote save command fails for rootless users. [rhel-10.2.z] (JIRA:Rocky     Linux-192440)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:37123 advisory.

    * golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate     (CVE-2026-39835)

    * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with     excessive parameters (CVE-2026-39829)

    * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling     of key restrictions (CVE-2026-39832)

    * golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via     unchecked SignatureKey (CVE-2026-42508)

    * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass     (CVE-2026-27136)

    * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)

    * podman: Podman: Information disclosure via malicious container image environment variables     (CVE-2026-57231)

    Bug Fix(es) and Enhancement(s):

    * podman does not clean up all files and leaves orphaned files consuming disk space [rhel-9.8.z]     (JIRA:Rocky Linux-173988)

    * [FJ9.8 Bug]: [REG]The podman-remote save command fails for rootless users. [rhel-9.8.z] (JIRA:Rocky     Linux-192439)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:37123 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fix(es):

    * golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate     (CVE-2026-39835)

    * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with     excessive parameters (CVE-2026-39829)

    * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling     of key restrictions (CVE-2026-39832)

    * golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via     unchecked SignatureKey (CVE-2026-42508)

    * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass     (CVE-2026-27136)

    * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)

    * podman: Podman: Information disclosure via malicious container image environment variables     (CVE-2026-57231)

    Bug Fix(es) and Enhancement(s):

    * podman does not clean up all files and leaves orphaned files consuming disk space [rhel-9.8.z]     (JIRA:RHEL-173988)

    * [FJ9.8 Bug]: [REG]The podman-remote save command fails for rootless users. [rhel-9.8.z]     (JIRA:RHEL-192439)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Podman installed on the remote host is prior to 5.8.4 / 6.0.0. It is, therefore, affected by an information disclosure vulnerability.

  - Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains an     environment variable with just a key and no value can trick podman into passing that variable from the host into the     container. This is made worse by the fact that using an asterisk (*) will cause podman to pass all host variables     into the container. So essentially a malicious image can exfiltrate all podman environment variables that are set in     the session from where the container is launched. This vulnerability is fixed in 5.8.4 and 6.0.0.
    (CVE-2026-57231)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:37072 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fix(es):

    * golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate     (CVE-2026-39835)

    * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with     excessive parameters (CVE-2026-39829)

    * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited     SSH responses (CVE-2026-39830)

    * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling     of key restrictions (CVE-2026-39832)

    * golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via     unchecked SignatureKey (CVE-2026-42508)

    * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass     (CVE-2026-27136)

    * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting     (CVE-2026-25681)

    * podman: Podman: Information disclosure via malicious container image environment variables     (CVE-2026-57231)

    Bug Fix(es) and Enhancement(s):

    * podman does not clean up all files and leaves orphaned files consuming disk space [rhel-10.2.z]     (JIRA:RHEL-173842)

    * [FJ10.2 Bug]: [REG]The podman-remote save command fails for rootless users. [rhel-10.2.z]     (JIRA:RHEL-192440)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that     contains a environment variable with just a key and no value can trick podman into passing that variable     from the host into the container. This is made worse by the fact that using an asterisk (*) will cause     podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all     podman environment variables that are set in the session from where the container is launched. This     vulnerability is fixed in 5.8.4 and 6.0.0. (CVE-2026-57231)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
333296	MiracleLinux 9 : podman-5.8.2-4.el9_8 (AXSA:2026-1491:07)	Nessus	Miracle Linux Local Security Checks	high
330115	MiracleLinux 8 : container-tools:rhel8 (AXSA:2026-1348:01)	Nessus	Miracle Linux Local Security Checks	high
329346	Oracle Linux 10 : podman (ELSA-2026-37072)	Nessus	Oracle Linux Local Security Checks	high
329116	Alibaba Cloud Linux 3 : 0221: podman (ALINUX3-SA-2026:0221)	Nessus	Alibaba Cloud Linux Local Security Checks	high
328403	TencentOS Server 3: container-tools:rhel8 (TSSA-2026:0661)	Nessus	Tencent Local Security Checks	high
327705	Oracle Linux 8 : container-tools:ol8 (ELSA-2026-38504)	Nessus	Oracle Linux Local Security Checks	high
327433	AlmaLinux 8 : container-tools:rhel8 (ALSA-2026:38504)	Nessus	Alma Linux Local Security Checks	high
326520	AlmaLinux 9 : podman (ALSA-2026:37123)	Nessus	Alma Linux Local Security Checks	high
326503	RockyLinux 8 : container-tools:rhel8 (RLSA-2026:38504)	Nessus	Rocky Linux Local Security Checks	high
326467	RHEL 8 : container-tools:rhel8 (RHSA-2026:38504)	Nessus	Red Hat Local Security Checks	high
326273	Oracle Linux 9 : podman (ELSA-2026-37123)	Nessus	Oracle Linux Local Security Checks	high
326261	RockyLinux 10 : podman (RLSA-2026:37072)	Nessus	Rocky Linux Local Security Checks	high
326254	RockyLinux 9 : podman (RLSA-2026:37123)	Nessus	Rocky Linux Local Security Checks	high
325904	RHEL 9 : podman (RHSA-2026:37123)	Nessus	Red Hat Local Security Checks	high
325892	Podman 1.8.1 < 5.8.4 / 6.0.0 Host Environment Variable Leak (GHSA-4hq8-gpf5-8p68)	Nessus	Misc.	high
325885	RHEL 10 : podman (RHSA-2026:37072)	Nessus	Red Hat Local Security Checks	high
323664	Linux Distros Unpatched Vulnerability : CVE-2026-57231	Nessus	Misc.	high

Detections

Analytics

CVE-2026-57231

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high