What is the CVSS score of CVE-2026-33897?

CVE-2026-33897 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Ssti are affected by CVE-2026-33897?

Incus container and virtual machine management systems prior to version 6.23.0 contain a critical authentication bypass that allows authorized users to escalate privileges and access arbitrary files…. A patch is available.

How to fix or mitigate CVE-2026-33897?

Within 24 hours: Identify all systems running Incus versions prior to 6.23.0 and document their criticality and network exposure. Within 7 days: Evaluate upgrade feasibility to Incus 6.23.0 or later; prioritize systems hosting sensitive workloads or those with untrusted user access. If immediate upgrade is not possible, implement the compensating controls listed below. Within 30 days: Complete patching of all affected Incus deployments to version 6.23.0 or later and validate remediation through security testing.

Ssti CVE-2026-33897

EUVD-2026-16466 CRITICAL

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-03-26 GitHub_M

Information Disclosure Ssti Red Hat Suse

9.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.1 HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 26, 2026 - 23:01 euvd

EUVD-2026-16466

Analysis Generated

Mar 26, 2026 - 23:01 vuln.today

CVE Published

Mar 26, 2026 - 22:43 nvd

CRITICAL 9.9

DescriptionGitHub Advisory

Incus is a system container and virtual machine manager. Prior to version 6.23.0, instance template files can be used to cause arbitrary read or writes as root on the host server. Incus allows for pongo2 templates within instances which can be used at various times in the instance lifecycle to template files inside of the instance. This particular implementation of pongo2 within Incus allowed for file read/write but with the expectation that the pongo2 chroot feature would isolate all such access to the instance's filesystem. This was allowed such that a template could theoretically read a file and then generate a new version of said file. Unfortunately the chroot isolation mechanism is entirely skipped by pongo2 leading to easy access to the entire system's filesystem with root privileges. Version 6.23.0 patches the issue.

AnalysisAI

Incus system container and virtual machine manager versions prior to 6.23.0 allow authenticated users with instance access to read and write arbitrary files as root on the host system through exploitation of pongo2 template processing. The vulnerability (scored CVSS 10.0 critical) stems from a bypassed chroot isolation mechanism that was intended to confine template operations to instance filesystems but instead permits unrestricted host filesystem access. No public exploit identified at time of analysis, though the vulnerability is tagged as Server-Side Template Injection (SSTI) with a GitHub security advisory published.

Technical ContextAI

Incus implements pongo2 template engine functionality for instance lifecycle management, allowing templated file generation within containers and virtual machines. The affected product is identified via CPE cpe:2.3:a:lxc:incus:*:*:*:*:*:*:*:* covering all versions before 6.23.0. The root cause is classified as CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), where the pongo2 chroot isolation feature that should restrict template file operations to the instance filesystem is completely bypassed. This design flaw enables template directives to traverse the chroot boundary and access the host's complete filesystem hierarchy with root privileges, converting what should be a sandboxed template rendering operation into an arbitrary file read/write primitive on the underlying host operating system.

RemediationAI

Upgrade Incus to version 6.23.0 or later, which contains the vendor-released patch addressing the pongo2 chroot bypass issue (see vendor advisory at https://github.com/lxc/incus/security/advisories/GHSA-83xr-5xxr-mh92). Until patching is completed, implement defense-in-depth controls including strict limitation of instance creation and management privileges to only highly trusted users, network segmentation to restrict Incus API access to authorized administrators only, and enhanced monitoring for unexpected file access patterns on host filesystems. Organizations should audit existing instance template configurations for potential abuse and review access logs for suspicious template-related operations during the vulnerable period. Given the scope change (S:C) in the CVSS vector indicating container escape potential, prioritize patching in multi-tenant and production environments where untrusted users have instance access.