CVE-2026-34045: 
Linux Red Hat vulnerability analysis and mitigation

CVE-2026-34045 is a dual-issue vulnerability in Podman Desktop's WebView HTTP server that enables unauthenticated remote denial-of-service and sensitive information disclosure. The server binds to all network interfaces (0.0.0.0) on port 44000 without authentication, connection limits, or timeouts, allowing any network-accessible attacker to exploit it. All versions up to and including 1.26.1 are affected; the issue is fixed in version 1.26.2. It carries a CVSS v3.1 base score of 8.2 (High) per the official advisory, though Feedly reports a score of 9.1 (GitHub Advisory).

The root cause is that the Podman Desktop WebView server (implemented in webview-registry.ts) binds to 0.0.0.0 instead of 127.0.0.1, exposing it to all network interfaces. Three CWEs apply: CWE-400 (Uncontrolled Resource Consumption) due to missing connection limits and request timeouts; CWE-284 (Improper Access Control) because the only access control — a Referer header check — only validates header presence, not value, and is trivially bypassed with Referer: http://anything; and CWE-209 (Generation of Error Message Containing Sensitive Information) because verbose Express.js error responses expose full stack traces including internal file paths and, on Windows, the current username. An attacker can flood the server with intentionally incomplete HTTP requests (Slowloris-style), exhausting file descriptors and kernel memory (each TCP connection consumes ~87 KB of kernel socket buffer), ultimately crashing the application or freezing the host (GitHub Advisory).

Exploitation can result in two distinct impacts: availability loss and information disclosure. On the availability side, flooding the server with ~10,000 connections (under a reduced FD limit) crashes Podman Desktop with an EMFILE error; under default Linux systemd FD limits (1,048,576), approximately 16 coordinated attacker machines can exhaust kernel memory and freeze the entire host, requiring a reboot. On the confidentiality side, crafted malformed requests elicit verbose error responses that reveal internal application paths, Node.js module structure, and — on Windows — the username of the logged-in user, which can facilitate follow-on credential attacks (GitHub Advisory).

A proof-of-concept exploit (a complete Python attack.py script implementing a Slowloris connection flood) is publicly available in the official GitHub Security Advisory. The advisory also includes step-by-step curl commands for triggering information disclosure. No authentication, credentials, or prior knowledge of the target beyond its IP address is required. The EPSS score is approximately 0.06%, and there is no current evidence of in-the-wild exploitation or CISA KEV catalog listing. The vulnerability was detected by Nessus plugin 312289 (GitHub Advisory, Tenable).

1. Reconnaissance: Identify hosts running Podman Desktop (versions ≤ 1.26.1) with port 44000 open using network scanners such as Nmap or Shodan.
2. Confirm server reachability: Send a probe request with a spoofed Referer header to bypass the presence-only check:

   curl -H "Referer: http://anything" http://<TARGET_IP>:44000/

   A response (even an error) confirms the server is accessible.
3. Trigger information disclosure: Send a malformed URI to elicit a verbose stack trace:

   curl --path-as-is -H "Referer: http://anything" "http://<TARGET_IP>:44000/5%"

   The response reveals internal file paths and, on Windows, the current username embedded in the stack trace.
4. Launch Slowloris connection flood (DoS): Run the attack.py script targeting port 44000, opening 20,000 incomplete HTTP connections that the server holds open indefinitely due to missing timeouts:

   # Incomplete request — server waits indefinitely for headers to complete
   REQUEST = b"GET / HTTP/1.1\r\nHost: <TARGET>:44000\r\nReferer: http://anything\r\nConnection: keep-alive\r\n"

5. Observe impact: Monitor file descriptor consumption on the target (ls /proc/<PID>/fd | wc -l). At ~5,000 connections, the WebView stops loading; at ~10,000 (with reduced FD limits), Podman Desktop crashes. At scale (16+ coordinated hosts against default limits), kernel memory exhaustion freezes the entire host (GitHub Advisory).

• Network: High volume of inbound TCP connections to port 44000 from one or more external IP addresses; connections that remain open without completing the HTTP handshake (no final \r\n terminating headers); repeated requests to http://<host>:44000/ with Referer: http://anything or similar arbitrary referer values.
• Process: Rapid growth in open file descriptors for the podman-desktop process (ls /proc/<PID>/fd | wc -l approaching the FD limit); Chromium/Electron subprocess reporting EMFILE: too many open files; unexpected application crash or host freeze.
• Logs: Express.js error responses containing URIError stack traces with internal paths (e.g., C:\Users\<username>\AppData\Local\...\node_modules\express\...) in HTTP response bodies; access logs showing repeated requests to / or malformed paths (e.g., /5%) on port 44000 from external IPs.
• System: Significant kernel memory consumption (multiple GB) attributable to TCP socket buffers; system-wide slowdown or freeze requiring reboot in severe cases (GitHub Advisory).

The primary fix is upgrading Podman Desktop to version 1.26.2 or later, which binds the WebView HTTP server to 127.0.0.1 instead of 0.0.0.0, making it unreachable from the network entirely. As an immediate workaround prior to patching, use host-based firewall rules (e.g., iptables, Windows Firewall) to block external access to TCP port 44000. Additional defense-in-depth measures implemented in the patch include setting server.maxConnections = 50, configuring server.headersTimeout and server.requestTimeout to 5000ms, and adding a catch-all error handler to suppress verbose stack traces. A Red Hat advisory (RHSA-2026:13867) is also available for the Red Hat build of Podman Desktop (GitHub Advisory, Red Hat Errata).

The vulnerability was published by benoitf on the Podman Desktop GitHub Security Advisories page on April 7, 2026, and was referenced in a CISA weekly vulnerability bulletin (SB26-103) for the week of April 6, 2026. Social media activity was observed on Bluesky and Mastodon shortly after disclosure. A technical write-up was published at infinitsec.net covering the WebView server exposure. Coverage was also picked up by Red Packet Security in their CISA vulnerability summary (CISA Bulletin, GitHub Advisory).