CVE-2026-33945
Description
A flaw was found in Incus, a system container and virtual machine manager. An attacker with the ability to configure Incus instances can exploit a path traversal vulnerability by manipulating the systemd.credential configuration key. This allows the attacker to write to arbitrary files as the root user, leading to both privilege escalation and denial of service within the system.
Statement
Critical: A path traversal vulnerability in Incus allows an attacker with the ability to configure Incus instances to write to arbitrary files as the root user. This can lead to privilege escalation and denial of service within the system. This issue affects Incus, which is available as a community project.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
