Incus CVE-2026-33897

Requires authenticated access to Incus (PR:L) prior to version 6.23.0. Attacker must craft malicious pongo2 template files in instance configurations to bypass chroot isolation and achieve arbitrary read/write as root on the host system.

The CVSS 3.1 score of 10.0 reflects network-accessible attack vector (AV:N), low complexity (AC:L), requirement for low privileges (PR:L), no user interaction (UI:N), and scope change (S:C) with high confidentiality, integrity, and availability impacts. However, real-world risk is moderated by the authentication requirement (PR:L indicates authenticated access needed) and the necessity for the attacker to have instance management permissions within Incus. The Server-Side Template Injection (SSTI) classification and information disclosure tags indicate exploitability is straightforward once access is obtained. With no EPSS score provided, no KEV listing, and no public exploit identified at time of analysis, this represents a critical architectural vulnerability requiring urgent patching in affected deployments but with lower immediate mass-exploitation risk compared to unauthenticated remote code execution flaws. Organizations running multi-tenant Incus environments face elevated risk as any tenant with instance privileges could compromise the entire host system.

An authenticated attacker with low-level instance creation privileges on an Incus host crafts a malicious pongo2 template file within their container that references paths outside the instance filesystem, such as /etc/shadow or /root/.ssh/authorized_keys on the host. When the template is processed during instance lifecycle events (startup, configuration changes), the bypassed chroot isolation allows the template engine running as root to read sensitive host files or write malicious content, enabling full host compromise including persistence mechanisms, credential theft, or lateral movement to other instances on the same hypervisor.