CVSS 4.0
5.7 mediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:PCVE-2026-33542
Medium (5.7) in linuxcontainers incus. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in github.com/lxc/incus/v6/client 6.23.0.
Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from simplestreams image servers opens the door to image cache poisoning and under very narrow circumstances exposes other tenants to running attacker controlled images rather than the expected one. Version 6.23.0 patches the issue.
Severity
CVSS 3.1
4.8 mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 7% of CVEs (scores of 2026-10-31)
- CWE
- CWE-295
- Published
- Modified
- Record from
- the NVD, synced
Affected
- linuxcontainers:incus
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-p8mm-23gg-jc9r | Go | github.com/lxc/incus/v6/client | <6.23.0 | 6.23.0 |
| GO-2026-4882 | Go | github.com/lxc/incus | all versions | no fix published |
| GO-2026-4882 | Go | github.com/lxc/incus/v6 | <6.23.0 | 6.23.0 |