CVE-2026-33414 containers CVE debrief

Who should care

Users of Podman versions 4.8.0 through 5.8.1, especially those using the HyperV machine backend on Windows installations, should be aware of this vulnerability. System administrators and security teams responsible for managing containerized environments should prioritize updating to version 5.8.2 or later to prevent potential exploitation.

Technical summary

The vulnerability is located in the HyperV machine backend in pkg/machine/hyperv/stubber.go. The VM image path is inserted into a PowerShell double-quoted string without proper sanitization, allowing for $() subexpression injection. This enables an attacker to execute arbitrary PowerShell commands with the privileges of the Podman process. The vulnerability is exclusive to the HyperV backend and only affects Windows installations. The CVSS score for this vulnerability is 4, indicating a medium severity level.

Defensive priority

Medium priority should be given to updating Podman to version 5.8.2 or later. System administrators should ensure that all affected systems are updated as soon as possible to prevent potential exploitation.

Recommended defensive actions

• Update Podman to version 5.8.2 or later
• Review and restrict VM image paths to prevent arbitrary input
• Monitor Podman logs for suspicious activity
• Implement additional security measures to detect and prevent exploitation attempts
• Conduct regular vulnerability assessments to identify potential weaknesses

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, its impact, and the affected versions. The source item URL provides additional context and references related to the vulnerability. The patch references indicate that the issue has been addressed in version 5.8.2.

Official resources