{
  "cveId": "CVE-2026-33945",
  "url": "https://patchblox.com/security/cve/CVE-2026-33945",
  "summary": "CVE-2026-33945 is fixed in 10 products on 1 platform, first by DEBIAN-CVE-2026-33945, released March 27, 2026. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "incus: Incus is a system container and virtual machine manager",
  "description": "Incus is a system container and virtual machine manager. Incus instances have an option to provide credentials to systemd in the guest. For containers, this is handled through a shared directory. Prior to version 6.23.0, an attacker can set a configuration key named something like \u0060systemd.credential.../../../../../../root/.bashrc\u0060 to cause Incus to write outside of the \u0060credentials\u0060 directory associated with the container. This makes use of the fact that the Incus syntax for such credentials is \u0060systemd.credential.XYZ\u0060 where \u0060XYZ\u0060 can itself contain more periods. While it\u0027s not possible to read any data this way, it\u0027s possible to write to arbitrary files as root, enabling both privilege escalation and denial of service attacks. Version 6.23.0 fixes the issue.",
  "published": "2026-03-27T00:16:23Z",
  "severity": "critical",
  "cvss": 9.6,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H",
  "epss": 0.00455,
  "epssPercentile": 0.39684,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "govulncheck-vulndb",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "0.0.20260723T184607-160000.1.1",
      "fix": "OPENSUSE-SU-2026:21483-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21483-1",
      "released": "2026-07-30T09:09:47Z"
    },
    {
      "platform": "linux",
      "product": "incus",
      "release": "Debian 14",
      "fixedVersion": "6.0.6-2",
      "fix": "DEBIAN-CVE-2026-33945",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-33945",
      "released": "2026-03-27T00:16:23Z"
    },
    {
      "platform": "linux",
      "product": "incus",
      "release": "Fedora 43",
      "fixedVersion": "6.23-3.fc43",
      "fix": "FEDORA-2026-094B7621CF",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-094b7621cf",
      "released": "2026-04-10T19:09:06Z"
    },
    {
      "platform": "linux",
      "product": "incus-agent",
      "release": "Fedora 43",
      "fixedVersion": "6.23-3.fc43",
      "fix": "FEDORA-2026-094B7621CF",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-094b7621cf",
      "released": "2026-04-10T19:09:06Z"
    },
    {
      "platform": "linux",
      "product": "incus-agent-debuginfo",
      "release": "Fedora 43",
      "fixedVersion": "6.23-3.fc43",
      "fix": "FEDORA-2026-094B7621CF",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-094b7621cf",
      "released": "2026-04-10T19:09:06Z"
    },
    {
      "platform": "linux",
      "product": "incus-client",
      "release": "Fedora 43",
      "fixedVersion": "6.23-3.fc43",
      "fix": "FEDORA-2026-094B7621CF",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-094b7621cf",
      "released": "2026-04-10T19:09:06Z"
    },
    {
      "platform": "linux",
      "product": "incus-client-debuginfo",
      "release": "Fedora 43",
      "fixedVersion": "6.23-3.fc43",
      "fix": "FEDORA-2026-094B7621CF",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-094b7621cf",
      "released": "2026-04-10T19:09:06Z"
    },
    {
      "platform": "linux",
      "product": "incus-debuginfo",
      "release": "Fedora 43",
      "fixedVersion": "6.23-3.fc43",
      "fix": "FEDORA-2026-094B7621CF",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-094b7621cf",
      "released": "2026-04-10T19:09:06Z"
    },
    {
      "platform": "linux",
      "product": "incus-debugsource",
      "release": "Fedora 43",
      "fixedVersion": "6.23-3.fc43",
      "fix": "FEDORA-2026-094B7621CF",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-094b7621cf",
      "released": "2026-04-10T19:09:06Z"
    },
    {
      "platform": "linux",
      "product": "incus-tools",
      "release": "Fedora 43",
      "fixedVersion": "6.23-3.fc43",
      "fix": "FEDORA-2026-094B7621CF",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-094b7621cf",
      "released": "2026-04-10T19:09:06Z"
    },
    {
      "platform": "linux",
      "product": "incus-tools-debuginfo",
      "release": "Fedora 43",
      "fixedVersion": "6.23-3.fc43",
      "fix": "FEDORA-2026-094B7621CF",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-094b7621cf",
      "released": "2026-04-10T19:09:06Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}