PT-2026-28560 · Incus+1 · Incus+1

Grmpyninja · Publicado 2026-01-01 · Atualizado 2026-04-20 · CVE-2026-33897

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Incus versions prior to 6.23.0

Description Incus, a system container and virtual machine manager, allows instance template files to be used to perform arbitrary read and write operations as root on the host server. The software utilizes pongo2 templates within instances, intended for templating files inside the instance. The pongo2 chroot isolation mechanism, designed to restrict file access to the instance's filesystem, is bypassed, granting access to the entire system's filesystem with root privileges. This issue impacts system security and could lead to data exposure or system manipulation.

Recommendations Update Incus to version 6.23.0 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-1336

Identificadores relacionados

BDU:2026-07327

CVE-2026-33897

GHSA-83XR-5XXR-MH92

GO-2026-4881

OPENSUSE-SU-2026:10450-1

Produtos afetados

Incus

Red Os

Referências · 32

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33897.json · Exploit
• https://github.com/lxc/incus · Nota
• https://github.com/lxc/incus/commit/487edf5984fad89b0f762c03a7e211fdd38396fb · Nota
• https://github.com/lxc/incus/security/advisories/GHSA-83xr-5xxr-mh92 · Aviso do Fabricante
• https://github.com/lxc/incus/pull/3092 · Nota
• https://twitter.com/0dayPublishing/status/2037302138888474950 · Publicação no Twitter
• https://twitter.com/CCBalert/status/2037530625385570572 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2026-33542 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-incus-cve-2026-33897-8.0 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-incus-cve-2026-33897-7.3 · Nota
• https://security-tracker.debian.org/tracker/CVE-2026-33897 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2037513410351382684 · Publicação no Twitter
• https://osv.dev/vulnerability/openSUSE-SU-2026:10450-1 · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2037311794709238187 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-33897 · Nota de Segurança