CVE-2026-23953

The record

A user with the ability to launch a container with a custom YAML configuration (e.g a member of the ‘incus’ group) can create an environment variable containing newlines, which can be used to add additional configuration items in the container’s `lxc.conf` due to the newline injection. This can allow adding arbitrary lifecycle hooks, ultimately resulting in arbitrary command execution on the host.

Affected packages

Related vulnerabilities

• GO-2026-4359 Incus container environment configuration newline injection in github.com/lxc/incus Same vulnerability
• GO-2026-4357 Incus container image templating arbitrary host file read and write in… Also affects github.com/lxc/incus
• CVE-2026-23954 Incus container image templating arbitrary host file read and write Also affects github.com/lxc/incus
• GO-2025-4115 Incus vulnerable to local privilege escalation through custom storage volumes in… Also affects github.com/lxc/incus
• CVE-2025-64507 Incus vulnerable to local privilege escalation through custom storage volumes Also affects github.com/lxc/incus
• CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb
• CVE-2026-34204 MinIO is a high-performance object storage system. Also affects govulncheck-vulndb
• CVE-2026-34041 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb