The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry (which it does by default since 5.0.0) allowing a possible Man In The Middle attack. Requirements to exploit: Access to the network path between registry and client to perform a MITM attack. Version affected: podman >= 4.8.0 Code was added in commit ea4775e, however it is only used as default way to pull images since 5.0.0.
Just noting that the code with the issue was first introduced in Podman v4.8 and RHEL 8.10 & 9.4. Also in OCP 4.16. Earlier versions of OCP and RHEL are not affected by this issue.