CVE-2026-34045 Podman Desktop WebView Server Exposed
Unauthenticated attackers can crash Podman Desktop or freeze the host via resource exhaustion and leak sensitive system details through verbose errors.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34045?
CVE-2026-34045 is a high-severity denial of service vulnerability in podman-desktop, published on 7 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Podman Desktop is a graphical tool for developing on containers and Kubernetes. Prior to 1.26.2, an unauthenticated HTTP server exposed by Podman Desktop allows any network attacker to remotely trigger denial-of-service conditions and extract sensitive information. By abusing missing connection limits and timeouts, an attacker can exhaust file descriptors and kernel memory, leading to application crash or full host freeze. Additionally, verbose error responses disclose internal paths and system details (including usernames on Windows), aiding further exploitation. The issue requires no authentication or user interaction and is exploitable over the network. This vulnerability is fixed in 1.26.2.
Which versions are affected by CVE-2026-34045?
It affects 1 product.
Linux distribution packages (1)
rh-podman-desktop Red Hat:enterprise_linux:10.1 | All versions | 0:1.0.1-4.el10_1 |
Products include Linuxfoundation Podman Desktop.
How do I fix CVE-2026-34045?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-34045 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34045 exists.
Other vulnerabilities in podman-desktop
Sources
Also known as RHSA-2026:13867.