Vulnerability · Published Mar 26, 2026 · Assigned by GitHub_M
CVE-2026-33542Incus does not verify combined fingerprint when downloading images from simplestreams servers
Medium 5.7
In plain English
A medium-severity improper certificate validation in incus from lxc. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from simplestreams image servers opens the door to image cache poisoning and under very narrow circumstances exposes other tenants to running attacker controlled images rather than the expected one. Version 6.23.0 patches the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | incus | 6.0.4-2+deb13u5 | DEBIAN-CVE-2026-33542 |
| Debian:13 | incus | 6.0.4-2+deb13u5 | DSA-6184-1 |
| Debian:14 | incus | 6.0.6-2 | DEBIAN-CVE-2026-33542 |
| Debian:12 | lxd | 5.0.2-5+deb12u4 | DSA-6188-1 |
| Debian:12 | lxd | no fix listed | DEBIAN-CVE-2026-33542 |
| Debian:13 | lxd | 5.0.2+git20231211.1364ae4-9+deb13u4 | DSA-6188-1 |
| Debian:13 | lxd | 5.0.2+git20231211.1364ae4-9+deb13u4 | DEBIAN-CVE-2026-33542 |
| Go | github.com/lxc/incus | no fix listed | GO-2026-4882 |
| Go | github.com/lxc/incus/v6 | 6.23.0 | GO-2026-4882 |
| Go | github.com/lxc/incus/v6/client | 6.23.0 | GHSA-p8mm-23gg-jc9r |
| Ubuntu:25.10 | incus | no fix listed | UBUNTU-CVE-2026-33542 |
| Ubuntu:26.10 | incus | no fix listed | UBUNTU-CVE-2026-33542 |
Affected products (as reported)
Weakness: CWE-295 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:P
References
- https://github.com/lxc/incus/security/advisories/GHSA-p8mm-23gg-jc9r x_refsource_CONFIRM