CVE-2026-33542: linuxcontainers incus Improper Certificate Validation
Vulnerability summary
CVE-2026-33542 is a medium (CVSS 5.7) Improper Certificate Validation vulnerability in linuxcontainers incus. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 8.7% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 4 · Related 2Timeline
- 26-03-2026PublishedVulnerability first disclosed.
- 30-03-2026Last modifiedVulnerability information updated.
Description
Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from simplestreams image servers opens the door to image cache poisoning and under very narrow circumstances exposes other tenants to running attacker controlled images rather than the expected one. Version 6.23.0 patches the issue.
CVSS metrics
7 scores · 5 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:PDiffers
- OSV · GoEcosystem advisory · calculated7.0HighCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:H/SI:L/SA:NDiffers
- NVDNIST5.7MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · DebianEcosystem advisory · calculated4.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- NVDNIST4.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS trend
Probability
0.20%
Chance of exploitation in the next 30 days
Percentile
9%
Versus all other CVEs
30-day change
+0.02 pp
From 0.18% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundIncus
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Debian2 products
- incus< 6.0.4-2+deb13u5 | < 6.0.6-2
- lxdAll versions (No fix recorded) | < 5.0.2+git20231211.1364ae4-9+deb13u4
Ubuntu2 products
- incusAll versions (No fix recorded)
- lxdAll versions (No fix recorded)
Github.com/lxc1 product
- incusAll versions (No fix recorded)
Github.com/lxc/incus1 product
- v6< 6.23.0
Github.com/lxc/incus/v61 product
- client< 6.23.0
Linuxcontainers1 product
- incus< 6.23.0
Lxc1 product
- incus< 6.23.0
7 vendors · 9 products
References
12 links- github.com/lxc/incus/security/advisories/GHSA-p8mm-23gg-jc9rX Refsource CONFIRMREPORTWEBAdvisoryExploitMitigationVendor Advisory
Show all 12 references
- github.com/lxc/incusPACKAGE