PT-2026-4281 · Lxc.Conf+3 · Lxc.Conf+3

Rmcnamara-Snyk · Published 2026-01-01 · Updated 2026-05-12 · CVE-2026-23953

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Incus versions 6.20.0 and below

Description Incus is a system container and virtual machine manager. A user with the ability to launch a container with a custom YAML configuration can create an environment variable containing newlines. This can be used to add additional configuration items in the container’s lxc.conf due to newline injection, potentially allowing the addition of arbitrary lifecycle hooks, ultimately resulting in arbitrary command execution on the host. Exploiting this issue on IncusOS requires a slight modification of the payload to change to a different writable directory for the validation step. The lxc.conf file is affected.

Recommendations Versions prior to 6.20.0 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-93

Related Identifiers

BDU:2026-00872

CVE-2026-23953

GHSA-X6JC-PHWX-HP32

GO-2026-4359

OPENSUSE-SU-2026:10280-1

SUSE-SU-2026:0403-1

Affected Products

Incus

Incusos

Red Os

Lxc.Conf

References · 105

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23953.json · Exploit
• 🔥❌ https://github.com/user-attachments/files/24473682/environment_newline_injection.sh · Exploit, Deleted
• https://github.com/lxc/incus/security/advisories/GHSA-x6jc-phwx-hp32 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23953 · Vendor Advisory
• ❌ https://github.com/user-attachments/files/24473685/environment_newline_injection.patch · Patch, Deleted
• https://bdu.fstec.ru/vul/2026-00872 · Security Note
• https://osv.dev/vulnerability/GHSA-x6jc-phwx-hp32 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4359 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23953 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10280-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23953 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23953 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23953 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23953 · Vendor Advisory