CVE-2026-33898 - Vulnerability Analysis

Overview

Incus prior to 6.23.0 contains an authentication bypass caused by incorrect validation of authentication tokens in the URL in the incus webui local web server, letting attackers with local or remote access escalate privileges or access user instances, exploit requires attacker to locate and interact with the local web server.

Severity & Score

Impact

Attackers can escalate privileges or access user Incus instances and system resources by exploiting token validation flaws in the local web server.

Mitigation

Update to version 6.23.0 or later.

References

• https://github.com/lxc/incus/security/advisories/GHSA-453r-g2pg-cxxq

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner