{"items":[{"id":"NVI-00013252","kind":"vulnerability","title":"podman quadlet install --replace does not fully replace the old file","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-fx76-2j3w-2mx6","CVE-2026-19730"],"plain_summary":"GitHub lists this reviewed advisory for github.com/containers/podman/v5. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2de26ba06ce0f4176a02267c66b0a4d2"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-24T16:28:27.000Z","value":"4.2 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-a6a3ab67dd8803bf4a75c3d56cff59e6"},{"kind":"CVSS","as_of":"2026-10-30T08:16:56.470Z","value":"4.2 MEDIUM (3.1)","meaning":"secalert@redhat.com severity; no combined Null risk score.","source_id":"sr-2de26ba06ce0f4176a02267c66b0a4d2"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-a6a3ab67dd8803bf4a75c3d56cff59e6","url":"https://github.com/advisories/GHSA-fx76-2j3w-2mx6","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-fx76-2j3w-2mx6","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T07:24:52.155Z"},{"id":"sr-2de26ba06ce0f4176a02267c66b0a4d2","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19730","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-19730","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-03T09:59:32.503Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-a6a3ab67dd8803bf4a75c3d56cff59e6"],"technology":"github.com/containers/podman/v5","known_exclusions":[],"conditions_summary":"### Impact\n\nWhen running `podman quadlet install --replace` to replace a Quadlet file, if the original Quadlet is larger than the new Quadlet, the file would not be truncated and content from the original would be preserved. There is no risk of information leakage as the user already had access to the Quadlet in order to replace it, and in most cases, this would only lead to invalid Quadlet files (see https://github.com/podman-container-tools/podman/issues/29013). However, security-related options from the end of the old Quadlet could be included in the new Quadlet, and if the truncation resulted in a valid Quadlet file, this could result in undesirable behavior. For example, running `podman quadlet install --replace` to remove a single line from the end of a Quadlet - including security-sensitive content, like `AddCapability` - will fail, and the option will continue to be used. Further, with Volume Quadlets, this can include additional mounts which can cause content to be unintentionally exposed into containers. If, later, the image is updated then compromised content might be leaked to an attacker.\n\nFirst introduced in commit 0ea4eaee70b7458bcc99d875529761faf5172651 with podman ","public_affected_ranges":[">= 5.7.0, < 5.8.6"]}],"null_published_at":"2026-11-03T10:03:31.390Z","source_updated_at":"2026-09-24T16:28:27.000Z","source_disclosed_at":"2026-09-24T16:28:26.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-01T07:24:52.155Z"},{"id":"NVI-00013252","kind":"vulnerability","title":"podman quadlet install --replace does not fully replace the old file","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-fx76-2j3w-2mx6","CVE-2026-19730"],"plain_summary":"GitHub lists this reviewed advisory for github.com/containers/podman/v5. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-a6a3ab67dd8803bf4a75c3d56cff59e6"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-24T16:28:27.000Z","value":"4.2 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-a6a3ab67dd8803bf4a75c3d56cff59e6"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-a6a3ab67dd8803bf4a75c3d56cff59e6","url":"https://github.com/advisories/GHSA-fx76-2j3w-2mx6","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-fx76-2j3w-2mx6","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T07:24:52.155Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-a6a3ab67dd8803bf4a75c3d56cff59e6"],"technology":"github.com/containers/podman/v5","known_exclusions":[],"conditions_summary":"### Impact\n\nWhen running `podman quadlet install --replace` to replace a Quadlet file, if the original Quadlet is larger than the new Quadlet, the file would not be truncated and content from the original would be preserved. There is no risk of information leakage as the user already had access to the Quadlet in order to replace it, and in most cases, this would only lead to invalid Quadlet files (see https://github.com/podman-container-tools/podman/issues/29013). However, security-related options from the end of the old Quadlet could be included in the new Quadlet, and if the truncation resulted in a valid Quadlet file, this could result in undesirable behavior. For example, running `podman quadlet install --replace` to remove a single line from the end of a Quadlet - including security-sensitive content, like `AddCapability` - will fail, and the option will continue to be used. Further, with Volume Quadlets, this can include additional mounts which can cause content to be unintentionally exposed into containers. If, later, the image is updated then compromised content might be leaked to an attacker.\n\nFirst introduced in commit 0ea4eaee70b7458bcc99d875529761faf5172651 with podman ","public_affected_ranges":[">= 5.7.0, < 5.8.6"]}],"null_published_at":"2026-11-01T07:29:12.932Z","source_updated_at":"2026-09-24T16:28:27.000Z","source_disclosed_at":"2026-09-24T16:28:26.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T07:24:52.155Z"}],"next_cursor":null,"snapshot_revision":"42594"}