CVE-2026-94603: Anthropic Python checkpoint

Q: Is CVE-2026-94603 actively exploited?

No confirmed active exploitation of CVE-2026-94603 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-94603?

1) Patch: upgrade to Podman 5.8.8 (github.com/containers/podman) or 6.1.3 (go.podman.io/podman/v6). The fix reverts the checkpoint-via-registry feature. 2) Workaround: scan images before pulling or running and reject any with the annotation `io.podman.annotations.checkpoint.runtime.name`. Podman cannot do this automatically, so use an admission step in the CI or registry proxy (for example with skopeo inspect). 3) Restrict pulls to trusted, allowlisted registries and pin images by digest. 4) Prefer rootless Podman where feasible, since it is not affected. 5) Detection: audit `podman run` history and registry pull logs for images with the annotation. Alert on containers whose effective capabilities exceed the requested flags, for example by comparing `podman inspect` CapAdd/CapDrop against the intended policy. 6) Review hosts that ran untrusted images since 4.4.0 for signs of host compromise and rotate secrets present on them.

Q: What systems are affected by CVE-2026-94603?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, CI/CD and MLOps runners, GPU container hosts, container registries.

Q: What is the CVSS score for CVE-2026-94603?

CVE-2026-94603 has a CVSS v3.1 base score of 10.0 (CRITICAL). The EPSS exploitation probability is 0.53%.

CISO Take

Podman 4.4 and later, including 5.x before 5.8.8 and 6.x before 6.1.3, treats an OCI image carrying a checkpoint annotation as a checkpoint. When `podman run` sees one, it silently ignores the operator's hardening flags such as `--cap-drop=ALL`. The image can then dictate its own capabilities and sandbox, which allows container escape to the host. The CVSS is 10.0, but the EPSS percentile is only the top 41%, no public exploit or Nuclei template exists, and it is not in CISA KEV. Exploitation also needs a rootful host to pull and run an attacker-controlled image, because rootless Podman does not support checkpoint/restore. With roughly 6,300 downstream dependents, the exposure is mostly on shared GPU/ML build, CI and inference hosts that pull third-party images. Upgrade to 5.8.8 or 6.1.3. Until then, reject images carrying the `io.podman.annotations.checkpoint.runtime.name` annotation and pull only from trusted, pinned registries.

Sources:NVDGitHub AdvisoryEPSSATLASpodman-container-tools/podman advisory GHSA-2cvf-wqm6-wr9g

What is the risk?

The base score is the maximum (CVSS 10.0, scope changed, high C/I/A), but real-world risk is MODERATE-HIGH and conditional. Exploitation needs a victim to pull and run an attacker-controlled image on a rootful Podman host. Rootless containers are not affected. EPSS is low (0.009, top 41%), there is no public exploit and no KEV listing, so there is no evidence of active exploitation. The flaw is a design-level trust failure (CWE-693) that is trivial to weaponize once an attacker can publish an image, because it needs only an annotation. Risk rises sharply on shared build, CI or GPU hosts and on pipelines that pull images from public or loosely governed registries. The AI/ML link is indirect: Podman is the container runtime beneath AI workloads, not an AI component.

How does the attack unfold?

Initial Access

Attacker publishes a malicious OCI image carrying the checkpoint annotation to a registry the victim pulls from.

AML.T0010.004

Execution

A victim runs the image with `podman run` on a rootful host, and Podman treats it as a checkpoint and ignores hardening flags such as `--cap-drop=ALL`.

Privilege Escalation

The image-defined capabilities and sandbox settings allow the workload to break out of the container.

AML.T0105

Impact

The attacker controls the host and can steal model weights, datasets and credentials, or tamper with ML workloads and move laterally.

Initial Access

Attacker publishes a malicious OCI image carrying the checkpoint annotation to a registry the victim pulls from.

AML.T0010.004

Execution

A victim runs the image with `podman run` on a rootful host, and Podman treats it as a checkpoint and ignores hardening flags such as `--cap-drop=ALL`.

Privilege Escalation

The image-defined capabilities and sandbox settings allow the workload to break out of the container.

AML.T0105

Impact

The attacker controls the host and can steal model weights, datasets and credentials, or tamper with ML workloads and move laterally.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Anthropic Python	go	>= 4.4.0, < 5.8.8	`5.8.8`
4.0K5.4K dependentsPushed 8d ago93% patched~9d to patchFull package profile →
Anthropic Python	go	>= 6.0.0, < 6.1.3	`6.1.3`
4.0K5.4K dependentsPushed 8d ago93% patched~9d to patchFull package profile →

How severe is it?

CVSS 3.1

10.0 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 45% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SChanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Patch: upgrade to Podman 5.8.8 (github.com/containers/podman) or 6.1.3 (go.podman.io/podman/v6). The fix reverts the checkpoint-via-registry feature. 2) Workaround: scan images before pulling or running and reject any with the annotation io.podman.annotations.checkpoint.runtime.name. Podman cannot do this automatically, so use an admission step in the CI or registry proxy (for example with skopeo inspect). 3) Restrict pulls to trusted, allowlisted registries and pin images by digest. 4) Prefer rootless Podman where feasible, since it is not affected. 5) Detection: audit podman run history and registry pull logs for images with the annotation. Alert on containers whose effective capabilities exceed the requested flags, for example by comparing podman inspect CapAdd/CapDrop against the intended policy. 6) Review hosts that ran untrusted images since 4.4.0 for signs of host compromise and rotate secrets present on them.

How is it classified?

Supply ChainCode ExecutionFrameworkInferenceAML.T0010- AI Supply Chain Compromise AML.T0010.004- Container Registry AML.T0105- Escape to Host AML.T0107- Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

GOVERN 6.1-Policies and procedures address third-party AI risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-94603?

Podman 4.4 and later, including 5.x before 5.8.8 and 6.x before 6.1.3, treats an OCI image carrying a checkpoint annotation as a checkpoint. When `podman run` sees one, it silently ignores the operator's hardening flags such as `--cap-drop=ALL`. The image can then dictate its own capabilities and sandbox, which allows container escape to the host. The CVSS is 10.0, but the EPSS percentile is only the top 41%, no public exploit or Nuclei template exists, and it is not in CISA KEV. Exploitation also needs a rootful host to pull and run an attacker-controlled image, because rootless Podman does not support checkpoint/restore. With roughly 6,300 downstream dependents, the exposure is mostly on shared GPU/ML build, CI and inference hosts that pull third-party images. Upgrade to 5.8.8 or 6.1.3. Until then, reject images carrying the `io.podman.annotations.checkpoint.runtime.name` annotation and pull only from trusted, pinned registries.

Is CVE-2026-94603 actively exploited?

No confirmed active exploitation of CVE-2026-94603 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-94603?

1) Patch: upgrade to Podman 5.8.8 (github.com/containers/podman) or 6.1.3 (go.podman.io/podman/v6). The fix reverts the checkpoint-via-registry feature. 2) Workaround: scan images before pulling or running and reject any with the annotation `io.podman.annotations.checkpoint.runtime.name`. Podman cannot do this automatically, so use an admission step in the CI or registry proxy (for example with skopeo inspect). 3) Restrict pulls to trusted, allowlisted registries and pin images by digest. 4) Prefer rootless Podman where feasible, since it is not affected. 5) Detection: audit `podman run` history and registry pull logs for images with the annotation. Alert on containers whose effective capabilities exceed the requested flags, for example by comparing `podman inspect` CapAdd/CapDrop against the intended policy. 6) Review hosts that ran untrusted images since 4.4.0 for signs of host compromise and rotate secrets present on them.

What systems are affected by CVE-2026-94603?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, CI/CD and MLOps runners, GPU container hosts, container registries.

What is the CVSS score for CVE-2026-94603?

CVE-2026-94603 has a CVSS v3.1 base score of 10.0 (CRITICAL). The EPSS exploitation probability is 0.53%.

What is the AI security impact?

Affected AI Architectures

model servingtraining pipelinesCI/CD and MLOps runnersGPU container hostscontainer registries

MITRE ATLAS Techniques

AML.T0010AI Supply Chain Compromise

AML.T0010.004Container Registry

AML.T0105Escape to Host

AML.T0107Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

### Impact Podman v4.4.0 added a feature where container checkpoints (from the `podman container checkpoint` command) could be distributed via OCI registry, and pulled from that registry and run via the `podman run` command. This allowed easy transfer of checkpoints between systems. However, checkpoints allow complete control of how the container is created - including full control of the container sandbox. When `podman run` detects a checkpoint, it will silently ignore all user input regarding how the container should be created - for example, `podman run --cap-drop=ALL` on an image that is determined to be a checkpoint will ignore `--cap-drop=all` and use the set of capabilities specified by the checkpoint image instead, which could include all capabilities. Podman identifies checkpoint images by looking for an annotation, `io.podman.annotations.checkpoint.runtime.name`. If this annotation is set, the image is treated as a checkpoint. Conflating container images and checkpoints in `podman run` allows inherently insecure behavior as the image can now control how it is executed. The Podman Maintainers have determined that the safest course of action is to remove this functionality. ### Patch The commit introducing this functionality was reverted. 3721ff82ffb44a4ceeaecc5abd3808e924a6b669 c74b1d37b3fb834b0de43e176565d9d8c254b627 fa6cef22c2baf3987b581c673bb416ef0585daf7 (main) ea9243e04d1db3886dc3a51ee3300ffb547cfc02 450c64426dbcff1097d3c7911d791101e3d16f4c 2d05a7c61f022d4f24980ea6d307fa53da2b8692 (v6.1) 7728ba0a90094408ad9078e36c3622a651d49616 24706290d5c974f078d8ca284026802515f28e92 29c8c6e50607df7a7d735ace09ff0ea099c0b3e0 (v5.8) ### Workarounds Images being pulled should be scanned for the `io.podman.annotations.checkpoint.runtime.name` annotation, and rejected if it is present. Podman does not presently have the ability to perform this scanning and rejection automatically. Also not that rootless containers are not affected as they do not support checkpoint/restore at all currently. ### Credits This vulnerability was discovered by ADA Logics Ltd using Anthropic's Claude models.

Exploitation Scenario

An attacker publishes an ML-themed image, such as a model-serving or fine-tuning base image, to a public registry. The image carries the checkpoint annotation and a checkpoint that requests all capabilities and a weakened sandbox. An MLOps engineer or CI runner on a rootful Podman host pulls and runs it with `--cap-drop=ALL` and other hardening flags. Podman ignores those flags and applies the image's own settings. The attacker's code breaks out of the container, takes control of the host, and harvests model weights, datasets, registry and cloud credentials. It can then move laterally to other GPU nodes or poison internal model artifacts.

Weaknesses (CWE)

CWE-693Protection Mechanism FailurePrimary

CWE-693 — Protection Mechanism Failure: The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Source: MITRE CWE corpus.