CVE-2026-33414

podman: github.com/containers/podman: Podman: Arbitrary code execution via command injection in HyperV backend

Loading…

Severity

Important

Red Hat Product Security

8.8

CVSS 3.1

Review impact separately from score.

Published · April 15, 2026

Updated · November 5, 2026

Description

A flaw was found in Podman, a tool for managing containers. This vulnerability, located in the HyperV machine backend, allows for command injection. An attacker who can manipulate the virtual machine (VM) image path can inject and execute arbitrary PowerShell commands. This could lead to unauthorized system-level code execution on Windows installations where Podman is running.

Statement

This flaw in Podman's HyperV backend does not affect Red Hat products. The vulnerable code path is exclusive to Windows installations, and the HyperV backend is not utilized on Red Hat Enterprise Linux or OpenShift Container Platform.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 8.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE-94 · Improper Control of Generation of Code