PT-2026-28494 · Incus+1 · Incus+1

Wl2018 · Published 2026-01-01 · Updated 2026-04-30 · CVE-2026-33542

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Incus versions prior to 6.23.0

Description Incus lacks validation of the image fingerprint when downloading from simplestreams image servers. This can lead to image cache poisoning, potentially allowing an attacker to provide a compromised image to other users on the system under narrow circumstances. An attacker requires access to an Incus server without proper image source restrictions (like restricted.image.servers or equivalent firewall rules) and the ability to predict which images other users might deploy. The attack involves serving a compromised image with the same fingerprint as a legitimate one, potentially replacing the legitimate image in the cache. This could affect systems running ephemeral instances for CI or build purposes, where image usage is more predictable.

Recommendations Versions prior to 6.23.0 should be updated to version 6.23.0 or later. As a temporary workaround, configure restricted.image.servers in the project configuration or implement equivalent firewall or HTTP proxy policies to restrict image sources.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

CWE-354

Related Identifiers

BDU:2026-07366

CVE-2026-33542

GHSA-P8MM-23GG-JC9R

GO-2026-4882

OPENSUSE-SU-2026:10450-1

Affected Products

Incus

Red Os

References · 31

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33542.json · Exploit
• https://github.com/lxc/incus/security/advisories/GHSA-p8mm-23gg-jc9r · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p8mm-23gg-jc9r · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-33542 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33542 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33542 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10450-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33542 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4882 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07366 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-33542 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33542 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33542 · Security Note
• https://github.com/lxc/incus/commit/72688b7d9400c8f3c17ad0f93a7c1aeb89627307 · Note
• https://github.com/lxc/incus/commit/04e97418189f743411884afb81a3384e6218b8cd · Note