CVE-2026-33542
Last modified
CVE-2026-33542 is a medium-severity vulnerability rated 4.8/10 on the CVSS scale. Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from simplestreams image servers opens the door to image cache poisoning and under very narrow circumstances exposes other tenants to running attacker controlled images rather than the expected one. EPSS estimates a 0.18% chance of exploitation in the next 30 days.
Description
Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from simplestreams image servers opens the door to image cache poisoning and under very narrow circumstances exposes other tenants to running attacker controlled images rather than the expected one. Version 6.23.0 patches the issue.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Linuxcontainers | Incus | < 6.23.0 |
References
- https://github.com/lxc/incus/security/advisories/GHSA-p8mm-23gg-jc9rExploit, Mitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-33542?
How severe is CVE-2026-33542?
How do I fix CVE-2026-33542?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-33537Lychee is a free, open-source photo-management tool. The pat…5
- CVE-2026-33538Parse Server is an open source backend that can be deployed …7.5
- CVE-2026-33539Parse Server is an open source backend that can be deployed …7.2
- CVE-2026-3354The Wikilookup plugin for WordPress is vulnerable to Stored …4.4
- CVE-2026-33540Distribution is a toolkit to pack, ship, store, and deliver …7.5
- CVE-2026-33541TSPortal is the WikiTide Foundation’s in-house platform used…6.5
- CVE-2026-33543FOSSBilling is a free, open-source billing and client manage…9.3
- CVE-2026-33544Tinyauth is an authentication and authorization server. Prio…7.7
- CVE-2026-33545MobSF is a mobile application security testing tool used. Pr…6.5
- CVE-2026-33548Mantis Bug Tracker (MantisBT) is an open source issue tracke…6.1
- CVE-2026-33549SPIP 4.4.10 through 4.4.12 before 4.4.13 allows unintended p…8.8
- CVE-2026-3355The Customer Reviews for WooCommerce plugin for WordPress is…6.1
Are you affected by CVE-2026-33542?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST