Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-34045 Details

Description

Podman Desktop is a graphical tool for developing on containers and Kubernetes. Prior to 1.26.2, an unauthenticated HTTP server exposed by Podman Desktop allows any network attacker to remotely trigger denial-of-service conditions and extract sensitive information. By abusing missing connection limits and timeouts, an attacker can exhaust file descriptors and kernel memory, leading to application crash or full host freeze. Additionally, verbose error responses disclose internal paths and system details (including usernames on Windows), aiding further exploitation. The issue requires no authentication or user interaction and is exploitable over the network. This vulnerability is fixed in 1.26.2.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:9.1 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

CNA: redhat-SADPCVSS-B:8.2 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://access.redhat.com/errata/RHSA-2026:13867	redhat-SADP
https://access.redhat.com/security/cve/CVE-2026-34045	redhat-SADP
https://bugzilla.redhat.com/show_bug.cgi?id=2456283	redhat-SADP
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34045.json	redhat-SADP
https://github.com/podman-desktop/podman-desktop/security/advisories/GHSA-2q88-39rh-gxvv	CISA-ADP	ExploitVendor Advisory
https://github.com/podman-desktop/podman-desktop/security/advisories/GHSA-2q88-39rh-gxvv	[email protected]	ExploitVendor Advisory

see all 6 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-209	Generation of Error Message Containing Sensitive Information	[email protected]
CWE-209	Generation of Error Message Containing Sensitive Information	[email protected]
CWE-284	Improper Access Control	[email protected]
CWE-400	Uncontrolled Resource Consumption	[email protected]
CWE-770	Allocation of Resources Without Limits or Throttling	redhat-SADP

Affected Products

Product	Versions
linuxfoundation podman desktop	< 1.26.2
CPE cpe:2.3:a:linuxfoundation:podman_desktop:::::::: Remediation No remediation found in references.

Change History

8 change records found show changes

Date	Action	Recorded By
Jul 24, 2026	CVE Translated	[email protected]
Jul 15, 2026	CVE Modified	redhat-SADP
Jun 30, 2026	CVE Modified	redhat-SADP
Jun 17, 2026	CVE Modified	CISA-ADP
Jun 17, 2026	CVE Modified	[email protected]
Apr 15, 2026	Initial Analysis	[email protected]
Apr 8, 2026	CVE Modified	CISA-ADP
Apr 7, 2026	New CVE Received	[email protected]