CVE-2026-34045 is a high severity (CVSS 8.2) flaw in Podman Desktop 1.26.1 and earlier. An unauthenticated HTTP server lets anyone on the network exhaust resources and leak internal paths. The maintainers fixed it in version 1.26.2, so upgrade there or later.
What's affected
Podman Desktop 1.26.1 and earlier are affected, per the project's advisory (GHSA-2q88-39rh-gxvv). Version 1.26.2 is the patched release. The advisory names the WebView HTTP server component and the Red Hat build of Podman Desktop as in scope.
The advisory says the server listens on port 44000 on all network interfaces, with no authentication, no limit on connections and no timeout. That means any machine that can reach the developer's laptop on that port can talk to it.
Red Hat also lists an erratum, RHSA-2026:13867, for its build. If you installed through Red Hat channels, use that package route and check the version it delivers.
How to check if you're exposed
Check the installed version from the application's About dialog and compare it with 1.26.2.
Then see whether the port is open on the machine. On Linux or macOS:
ss -ltn | grep 44000
lsof -iTCP:44000 -sTCP:LISTEN
The first command works on Linux and the second on macOS and Linux. A listener bound to all interfaces (shown as * or 0.0.0.0) is the exposed state the advisory describes.
From a second machine on the same network, a port scan limited to your own hosts shows which developer machines answer on 44000. Run it only against systems you own.
In a company, ask your endpoint management tool for the Podman Desktop version across laptops. Developer tools are often installed outside software catalogs, so a package inventory may miss them.
On Windows, use netstat -ano | findstr :44000 from a command prompt to see whether anything listens on the port, and which process owns it. The advisory says usernames can leak in error messages on Windows, so desktops there are in scope too.
Keep in mind that the advisory describes the server as available to every network interface. A laptop on a home network is only reachable by that network, but the same laptop on a conference network may be reachable by hundreds of strangers. Where the machine sits matters as much as the version.
What to do now
- List the machines that run Podman Desktop, including personal installs on work laptops.
- Upgrade each one to 1.26.2 or later.
- Until the upgrade lands, block inbound traffic to port 44000 with the host firewall.
- Avoid running Podman Desktop on untrusted networks such as conference or cafe Wi-Fi.
- Restart the application after the upgrade and confirm the version.
- Add developer tools to your software inventory so the next advisory is easy to scope.
- Ask endpoint management for a list of Podman Desktop versions, since developer tools are often missing from catalogs.
- Add a standing rule that tools opening local ports must bind to loopback unless there is a written reason.
Why it matters
The record lists four weaknesses. CWE-284 is improper access control: the server answers anyone. CWE-770 and CWE-400 cover allocation of resources without limits and uncontrolled resource consumption. Without a cap on connections or a timeout, open sockets pile up until the process, and in the advisory's words possibly the host, runs out of file descriptors or kernel memory. CWE-209 covers error messages that reveal internal paths and, on Windows, usernames.
It is easy to dismiss desktop tooling, because the app runs on one laptop. But developer machines hold source code, tokens and container credentials, and a freeze or crash on a build host can stop work. Local services bound to every interface are a common mistake: a service meant for the local browser should listen on loopback only.
The record does not mark this CVE as exploited, and it is not on the CISA KEV list.
The advisory's own estimate is worth reading. It says the connection flood can reach a host's file descriptor limit of 1,048,576 with about 16 machines. A single machine with a lower limit needs far fewer. The researchers lowered the limit to ease testing, which tells you the limit is the real boundary, and that varies by system.
For people who build desktop apps, the lesson is plain. A helper server that exists only to serve the app's own window should bind to the loopback address, require a per-session secret, cap connections, set read timeouts, and return short error messages without paths. Any one of those would have limited the damage here. Review your own tools for servers that were added for convenience and never revisited.
For security teams, desktop container tools are easy to overlook in inventory. They are installed by individuals, updated by hand and absent from server scans. Ask for a list of installed developer tools on managed laptops, and add this version check to it.
Quick check
Does a host firewall remove the risk?
It removes the network path to port 44000 if it blocks inbound traffic, but the advisory's fix is the upgrade to 1.26.2. Use the firewall as a stopgap only.
Sources
Last reviewed: 19 October 2026.
