CVE-2026-33945: Incus v6 Path Traversal Vulnerability (CRITICAL)

CVE-2026-33945 in Incus allows for arbitrary file write vulnerabilities stemming from improper handling of the systemd-creds options within the github.com/lxc/incus project. An attacker with the ability to influence the configuration of Incus, specifically the systemd-creds settings, can leverage this flaw to write arbitrary files to the host system. This could involve overwriting critical system files, injecting malicious code, or exfiltrating sensitive data. The blast radius extends to the entire host system running Incus, as successful exploitation grants the attacker the ability to modify any file accessible by the user account associated with the systemd-creds configuration. For example, an attacker could overwrite /etc/passwd to gain root access, or modify configuration files for other services running on the host, leading to a complete compromise of the system. The severity is rated Critical (CVSS 9.9) due to the potential for complete system takeover and the relative ease with which an attacker could exploit the vulnerability if they have control over the Incus configuration. The impact is particularly severe in environments where Incus is used to manage container infrastructure, as a compromised Incus instance could lead to the compromise of multiple containers and the underlying host.

1. Reserved2026-03-24
2. Published2026-04-07
3. EPSS updated2026-04-03

The primary mitigation for CVE-2026-33945 is to upgrade Incus to version 6.23.0 or later. This version includes a fix that addresses the arbitrary file write vulnerability. If upgrading is not immediately feasible, a temporary workaround involves carefully restricting the permissions and access granted to the user account used for systemd-creds authentication. This should include limiting the directories and files that the user can write to. Thoroughly review and audit the Incus configuration to ensure that the systemd-creds options are not being misused. After applying the upgrade or implementing the workaround, verify the fix by attempting to trigger the vulnerability using a controlled test environment. This should involve simulating an attacker's attempt to write an arbitrary file and confirming that the attempt is blocked. Regular security audits and vulnerability scanning of the Incus deployment are also recommended to proactively identify and address potential security weaknesses.