Is CVE-2026-33414 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33414 being exploited in the wild.

How severe is CVE-2026-33414?

High severity, with a CVSS score of 7.8, published 14 April 2026.

Which products and versions are affected?

Containers Podman >= 4.8.0, < 5.8.2; github.com/containers/podman (Go) SEMVER:introduced=0; github.com/containers/podman/v2 (Go) SEMVER:introduced=0; github.com/containers/podman/v3 (Go) SEMVER:introduced=0; and 2 more.

Is there a fix for CVE-2026-33414?

Yes. github.com/containers/podman/v5 (Go): upgrade to 5.8.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33414 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-33414?

Check whether you run Containers Podman, github.com/containers/podman (Go), github.com/containers/podman/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33414: Podman command injection in HyperV machine backend

Q: Is there a fix for CVE-2026-33414?

Yes. github.com/containers/podman/v5 (Go): upgrade to 5.8.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-33414 attacked?

It is attacked with local access, in a network appliance.

Q: Am I affected by CVE-2026-33414?

Check whether you run Containers Podman, github.com/containers/podman (Go), github.com/containers/podman/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33414 · Severity: high · CVSS 7.8 · Published 2026-04-14

Podman is a tool used to manage and run software containers. A security flaw in its Windows-specific HyperV component allows an attacker to execute unauthorized commands on the host computer. If exploited, this could allow a malicious actor to take full control of the Windows system with administrative (SYSTEM) privileges.

Technologies: Containers Podman, github.com/containers/podman (Go), github.com/containers/podman/v2 (Go), github.com/containers/podman/v3 (Go), github.com/containers/podman/v4 (Go), github.com/containers/podman/v5 (Go), Microsoft Windows. Vendors: Containers, Go, Microsoft.

Quick answers

Is CVE-2026-33414 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33414 being exploited in the wild.
How severe is CVE-2026-33414?: High severity, with a CVSS score of 7.8, published 14 April 2026.
Which products and versions are affected?: Containers Podman >= 4.8.0, < 5.8.2; github.com/containers/podman (Go) SEMVER:introduced=0; github.com/containers/podman/v2 (Go) SEMVER:introduced=0; github.com/containers/podman/v3 (Go) SEMVER:introduced=0; and 2 more.
Is there a fix for CVE-2026-33414?: Yes. github.com/containers/podman/v5 (Go): upgrade to 5.8.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33414 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-33414?: Check whether you run Containers Podman, github.com/containers/podman (Go), github.com/containers/podman/v2 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/containers/podman/v5 (Go): upgrade to 5.8.2 or later
```
go get github.com/containers/podman/v5@v5.8.2
```

Technical details

A command injection vulnerability exists in Podman's HyperV machine backend within `pkg/machine/hyperv/stubber.go`. The root cause is the improper sanitization of the VM image path when it is inserted into a PowerShell double-quoted string via `fmt.Sprintf` for the `Resize-VHD` command. Because PowerShell evaluates `$()` subexpressions inside double-quoted strings, an attacker who can influence the VM image path (e.g., through a crafted machine name or directory) can achieve arbitrary code execution. On Windows, this typically results in execution with SYSTEM-level privileges. This vulnerability only affects Windows installations using the HyperV backend. The issue is addressed in version 5.8.2 by passing the path via an environment variable rather than direct string interpolation.

Affected products

containers Podman >= 4.8.0, < 5.8.2

Identifiers

CVE-2026-33414
GHSA-hc8w-h2mf-hp59
GO-2026-5421

Timeline

2026-04-14: disclosed
2026-04-14: advisory
2026-04-14: patched: Fixed in version 5.8.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.