After updating, inspect installed Quadlet unit files, especially where a configuration was replaced by a shorter version.
Podman 5.8.6 fixes CVE-2026-19730 in the Quadlet installation path. Versions 5.7.0 through 5.8.5 are affected.
When podman quadlet install --replace was used, the old file was not always fully truncated. If the new configuration was shorter, trailing directives such as AddCapability, extra mounts, or other security-related settings could remain active.
The issue is rated Moderate with a CVSS score of 4.2. It is not remote code execution: a user or operator needs local permission to replace Quadlet configurations. Podman 6.0.0 and later are not affected.
Servers running Podman 5.x should be updated to 5.8.6. Administrators who previously used install --replace should inspect the installed unit files themselves rather than relying only on the source template.