CVE catalog

CVE-2026-33898

Incus is a system container and virtual machine manager. Prior to version 6.23.0, the web server spawned by `incus webui` incorrectly validates the authentication token such that an invalid value will

[CVE catalog]

Severity: High · CVSS 8.8
Published: Mar 26, 2026, 11:25:45 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.35% · Oct 25, 2026

A flaw was found in Incus, a system container and virtual machine manager. The `incus webui` component incorrectly validates authentication tokens when they are passed in the URL. This vulnerability allows a local attacker, or a remote attacker who can trick a local user into interacting with the Incus UI web server, to gain unauthorized access. Successful exploitation could lead to privilege escalation or unauthorized access to Incus instances and potentially system resources. Important: This flaw in the `incus webui` component allows for privilege escalation and unauthorized access. The vulnerability arises from improper authentication token validation when tokens are passed in the URL, enabling a local attacker or a remote attacker (via user interaction) to gain access to Incus instances and potentially system resources. Exploitation requires the `incus webui` server to be running and accessible. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Cpe	incus	Not reported	`6.23.0`	fixed
Debian	incus	13	`6.0.4-2`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u1`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u10`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u11`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u1~bpo12+1`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u2`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u2~bpo12+1`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u3`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u3~bpo12+1`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u4`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u4~bpo12+1`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u5`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u5~bpo12+1`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u6`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u6~bpo12+1`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u7`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u7~bpo12+1`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u8`	vulnerable
Debian	incus	13	`6.0.4-2+deb13u9`	vulnerable
Debian	incus	13	`6.0.4-3`	vulnerable
Debian	incus	13	`6.0.5-1`	vulnerable
Debian	incus	13	`6.0.5-2`	vulnerable
Debian	incus	13	`6.0.5-3`	vulnerable
Debian	incus	13	`6.0.5-4`	vulnerable
Debian	incus	13	`6.0.5-5`	vulnerable
Debian	incus	13	`6.0.5-6`	vulnerable
Debian	incus	13	`6.0.5-7`	vulnerable
Debian	incus	13	`6.0.5-8`	vulnerable
Debian	incus	13	`6.0.6-1`	vulnerable
Debian	incus	13	`6.0.6-2`	vulnerable
Debian	incus	13	`6.0.6-3`	vulnerable
Debian	incus	13	`6.14.0-1~exp1`	vulnerable
Debian	incus	13	`6.15.0-1~exp1`	vulnerable
Debian	incus	13	`6.16.0-1~exp1`	vulnerable
Debian	incus	13	`6.17.0-1~exp1`	vulnerable
Debian	incus	13	`6.20.0-1~exp1`	vulnerable
Debian	incus	13	`6.21.0-1~exp1`	vulnerable
Debian	incus	13	`6.22.0-1~exp1`	vulnerable
Debian	incus	13	`6.23.0-1~exp1`	vulnerable
Debian	incus	13	`7.0.0-1`	vulnerable
Debian	incus	13	`7.0.0-1~bpo13+1`	vulnerable
Debian	incus	13	`7.0.0-2`	vulnerable
Debian	incus	13	`7.0.0-2~bpo13+1`	vulnerable
Debian	incus	13	`7.0.0-3`	vulnerable
Debian	incus	13	`7.0.0-4`	vulnerable
Debian	incus	13	`7.0.0-5`	vulnerable
Debian	incus	13	`7.0.0-5~bpo13+1`	vulnerable
Debian	incus	13	`7.0.1-1`	vulnerable
Debian	incus	13	`7.0.1-1~bpo13+1`	vulnerable
Debian	incus	13	`7.0.1-2`	vulnerable
Debian	incus	13	`7.0.1-2~bpo13+1`	vulnerable
Debian	incus	13	`7.0.1-3`	vulnerable
Debian	incus	13	`7.0.1-3~bpo13+1`	vulnerable
Debian	incus	13	`7.0.1-4`	vulnerable
Debian	incus	13	`7.0.1-5`	vulnerable
Debian	incus	13	`7.1.0-1~exp1`	vulnerable
Debian	incus	13	`7.2.0-1~exp1`	vulnerable
Debian	incus	13	`7.2.0-1~exp2`	vulnerable
Debian	incus	13	`7.2.0-1~exp3`	vulnerable
Debian	incus	13	`7.3.0-1~exp1`	vulnerable
Debian	incus	13	`7.4.0-1~exp1`	vulnerable
Debian	incus	13	`7.5.1-1~exp1`	vulnerable
Debian	incus	14	`6.0.4-2`	vulnerable
Debian	incus	14	`6.0.4-3`	vulnerable
Debian	incus	14	`6.0.5-1`	vulnerable
Debian	incus	14	`6.0.5-2`	vulnerable
Debian	incus	14	`6.0.5-3`	vulnerable
Debian	incus	14	`6.0.5-4`	vulnerable
Debian	incus	14	`6.0.5-5`	vulnerable
Debian	incus	14	`6.0.5-6`	vulnerable
Debian	incus	14	`6.0.5-7`	vulnerable
Debian	incus	14	`6.0.5-8`	vulnerable
Debian	incus	14	`6.0.6-1`	vulnerable
Debian	incus	14	`6.0.6-2`	vulnerable
Debian	incus	14	`6.0.6-3`	vulnerable
Debian	incus	14	`6.14.0-1~exp1`	vulnerable
Debian	incus	14	`6.15.0-1~exp1`	vulnerable
Debian	incus	14	`6.16.0-1~exp1`	vulnerable
Debian	incus	14	`6.17.0-1~exp1`	vulnerable
Debian	incus	14	`6.20.0-1~exp1`	vulnerable
Debian	incus	14	`6.21.0-1~exp1`	vulnerable
Debian	incus	14	`6.22.0-1~exp1`	vulnerable
Debian	incus	14	`6.23.0-1~exp1`	vulnerable
Debian	incus	14	`7.0.0-1~bpo13+1`	vulnerable
Debian	incus	14	`7.0.0-1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Cpe	incus	cpe	Not reported	`6.23.0`	Not reported	Not reported	Not reported
Debian	incus	deb	14	`7.0.0-1`	Not reported	DEBIAN-CVE-2026-33898	Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

[golang-github-lxc-incus-dev]Affected
Source package: [incus]
Details (7)
- 6.0.4-2+deb13u8 · all · trixie
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u8 · all · trixie
  Affected
  nvd · incus · debian · 13
- 7.0.1-2~bpo13+1 · all · trixie-backports
  Affected
  nvd · incus · debian · 13
- 7.0.1-2~bpo13+1 · all · trixie-backports
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u11 · all · trixie-security
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u9 · all · trixie-security · Historical version
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u9 · all · trixie-security
  Affected
  nvd · incus · debian · 13
[incus]Affected
Details (7)
- 6.0.4-2+deb13u8 · amd64 · trixie
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u8 · arm64 · trixie
  Affected
  nvd · incus · debian · 13
- 7.0.1-2~bpo13+1 · amd64 · trixie-backports
  Affected
  nvd · incus · debian · 13
- 7.0.1-2~bpo13+1 · arm64 · trixie-backports
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u11 · amd64 · trixie-security
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u9 · amd64 · trixie-security · Historical version
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u9 · arm64 · trixie-security
  Affected
  nvd · incus · debian · 13
[incus-agent]Affected
Source package: [incus]
Details (7)
- 6.0.4-2+deb13u8 · amd64 · trixie
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u8 · arm64 · trixie
  Affected
  nvd · incus · debian · 13
- 7.0.1-2~bpo13+1 · amd64 · trixie-backports
  Affected
  nvd · incus · debian · 13
- 7.0.1-2~bpo13+1 · arm64 · trixie-backports
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u11 · amd64 · trixie-security
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u9 · amd64 · trixie-security · Historical version
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u9 · arm64 · trixie-security
  Affected
  nvd · incus · debian · 13
[incus-base]Affected
Source package: [incus]
Details (7)
- 6.0.4-2+deb13u8 · amd64 · trixie
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u8 · arm64 · trixie
  Affected
  nvd · incus · debian · 13
- 7.0.1-2~bpo13+1 · amd64 · trixie-backports
  Affected
  nvd · incus · debian · 13
- 7.0.1-2~bpo13+1 · arm64 · trixie-backports
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u11 · amd64 · trixie-security
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u9 · amd64 · trixie-security · Historical version
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u9 · arm64 · trixie-security
  Affected
  nvd · incus · debian · 13
[incus-client]Affected
Source package: [incus]
Details (7)
- 6.0.4-2+deb13u8 · amd64 · trixie
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u8 · arm64 · trixie
  Affected
  nvd · incus · debian · 13
- 7.0.1-2~bpo13+1 · amd64 · trixie-backports
  Affected
  nvd · incus · debian · 13
- 7.0.1-2~bpo13+1 · arm64 · trixie-backports
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u11 · amd64 · trixie-security
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u9 · amd64 · trixie-security · Historical version
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u9 · arm64 · trixie-security
  Affected
  nvd · incus · debian · 13
[incus-extra]Affected
Source package: [incus]
Details (7)
- 6.0.4-2+deb13u8 · amd64 · trixie
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u8 · arm64 · trixie
  Affected
  nvd · incus · debian · 13
- 7.0.1-2~bpo13+1 · amd64 · trixie-backports
  Affected
  nvd · incus · debian · 13
- 7.0.1-2~bpo13+1 · arm64 · trixie-backports
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u11 · amd64 · trixie-security
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u9 · amd64 · trixie-security · Historical version
  Affected
  nvd · incus · debian · 13
- 6.0.4-2+deb13u9 · arm64 · trixie-security
  Affected
  nvd · incus · debian · 13

Observed: Oct 27, 2026, 8:01:33 AM UTC

References

[FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]