CVE-2026-33414

[CVE catalog]

Severity

High · CVSS 8.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Published

Apr 14, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.61% · Oct 25, 2026

A flaw was found in Podman, a tool for managing containers. This vulnerability, located in the HyperV machine backend, allows for command injection. An attacker who can manipulate the virtual machine (VM) image path can inject and execute arbitrary PowerShell commands. This could lead to unauthorized system-level code execution on Windows installations where Podman is running. podman: github.com/containers/podman: Podman: Arbitrary code execution via command injection in HyperV backend This flaw in Podman's HyperV backend does not affect Red Hat products. The vulnerable code path is exclusive to Windows installations, and the HyperV backend is not utilized on Red Hat Enterprise Linux or OpenShift Container Platform. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.