Junglewise Threat Intelligence

CVE-2026-33414: Podman command injection in HyperV machine backend

CVE-2026-33414 · Severity: high · CVSS 7.8 · Published 2026-04-14

Executive brief

Podman is a tool used to manage and run software containers. A security flaw in its Windows-specific HyperV component allows an attacker to execute unauthorized commands on the host computer. If exploited, this could allow a malicious actor to take full control of the Windows system with administrative (SYSTEM) privileges.

Technical details

A command injection vulnerability exists in Podman's HyperV machine backend within `pkg/machine/hyperv/stubber.go`. The root cause is the improper sanitization of the VM image path when it is inserted into a PowerShell double-quoted string via `fmt.Sprintf` for the `Resize-VHD` command. Because PowerShell evaluates `$()` subexpressions inside double-quoted strings, an attacker who can influence the VM image path (e.g., through a crafted machine name or directory) can achieve arbitrary code execution. On Windows, this typically results in execution with SYSTEM-level privileges. This vulnerability only affects Windows installations using the HyperV backend. The issue is addressed in version 5.8.2 by passing the path via an environment variable rather than direct string interpolation.

Affected products

  • containers Podman >= 4.8.0, < 5.8.2

Timeline

  • 2026-04-14: disclosed
  • 2026-04-14: advisory
  • 2026-04-14: patched: Fixed in version 5.8.2

References

Related threats