CVE-2026-33898
Description
A flaw was found in Incus, a system container and virtual machine manager. The incus webui component incorrectly validates authentication tokens when they are passed in the URL. This vulnerability allows a local attacker, or a remote attacker who can trick a local user into interacting with the Incus UI web server, to gain unauthorized access. Successful exploitation could lead to privilege escalation or unauthorized access to Incus instances and potentially system resources.
Statement
Important: This flaw in the incus webui component allows for privilege escalation and unauthorized access. The vulnerability arises from improper authentication token validation when tokens are passed in the URL, enabling a local attacker or a remote attacker (via user interaction) to gain access to Incus instances and potentially system resources. Exploitation requires the incus webui server to be running and accessible.
Mitigation
To mitigate this issue, avoid running the `incus webui` command if the web interface functionality is not required. The `incus webui` component spawns a local web server, and refraining from its use eliminates the attack vector. If `incus webui` must be used, ensure that only trusted users have access to the system where it is run and exercise caution with any remote interactions that might trick a local user into accessing the Incus UI web server.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
