CVE-2026-33542
Medium · 4.8CVSS
4.8
EPSS
0.2%
Published
Mar 26, 2026
CISA due date
—
The record
Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from simplestreams image servers opens the door to image cache poisoning and under very narrow circumstances exposes other tenants to running attacker controlled images rather than the expected one. Version 6.23.0 patches the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | incus | 0 | 6.23-1.1 |
Related vulnerabilities
- CVE-2026-33898 Incus is a system container and virtual machine manager. Also affects incus
- CVE-2026-33945 Incus is a system container and virtual machine manager. Also affects incus
- CVE-2026-33711 Incus is a system container and virtual machine manager. Also affects incus
- CVE-2026-33743 Incus is a system container and virtual machine manager. Also affects incus
- CVE-2026-33897 Incus is a system container and virtual machine manager. Also affects incus
- CVE-2026-23954 Incus container image templating arbitrary host file read and write Also affects incus
- CVE-2026-23953 Incus container environment configuration newline injection Also affects incus
- CVE-2026-96375 Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the… CWE-295