Incus EUVD-2026-16490

Victim must access the local web server spawned by incus webui (running on random localhost port) with a crafted or invalid authentication token. Requires user interaction to click a malicious link containing the token. Affects Incus versions prior to 6.23.0.

The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates network-based attack with low complexity, no privileges required, but user interaction needed, yielding an 8.8 severity score. The attack requires either local network access to the ephemeral localhost web server or social engineering to trick users into accessing attacker-controlled URLs. Real-world exploitation risk is moderate: while the CVSS score is high and the technical barrier is low, successful exploitation requires timing (web server must be active), discoverability (random port on localhost), and either local access or user interaction with malicious links. No public exploit identified at time of analysis and no CISA KEV listing indicates exploitation has not been observed in the wild. The impact is significant for multi-user systems where local privilege escalation is possible, or environments where users may be tricked into interacting with malicious web resources while the webui is active.

A local attacker on a shared system discovers an active Incus webui instance listening on a random localhost port through port scanning or process enumeration. Without possessing the legitimate authentication token, the attacker crafts HTTP requests with invalid token values in the URL parameters, which the vulnerable validation logic incorrectly accepts. The attacker gains full access to manage the victim user's containers and virtual machines, potentially escaping to the host system or pivoting to other network resources. Alternatively, a remote attacker sends a phishing link to a user actively running 'incus webui', exploiting the authentication bypass to execute commands with the victim's Incus privileges when the user clicks the malicious URL.