CVE-2026-23953
published 2026-01-22CVE-2026-23953: Incus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch a container with a custom YAML…
PriorityP355high8.7CVSS 3.1
AVAACLPRLUINSCCHIHAN
EPSS
0.47%
37.5th percentile
Incus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch a container with a custom YAML configuration (e.g a member of the ‘incus’ group) can create an environment variable containing newlines, which can be used to add additional configuration items in the container’s lxc.conf due to newline injection. This can allow adding arbitrary lifecycle hooks, ultimately resulting in arbitrary command execution on the host. Exploiting this issue on IncusOS requires a slight modification of the payload to change to a different writable directory for the validation step (e.g /tmp). This can be confirmed with a second container with /tmp mounted from the host (A privileged action for validation only). A fix is planned for versions 6.0.6
and 6.21.0, but they have not been released at the time of publication.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | lxd | >= 0 < 5.0.2-5+deb12u3 | 5.0.2-5+deb12u3 |
| canonical | lxd | >= 0 < 5.0.2+git20231211.1364ae4-9+deb13u3 | 5.0.2+git20231211.1364ae4-9+deb13u3 |
| debian | incus | < incus 6.0.5-8 (forky) | incus 6.0.5-8 (forky) |
| debian | lxd | < incus 6.0.5-8 (forky) | incus 6.0.5-8 (forky) |
| github.com | lxc_incus_v6 | >= 0 < 6.21.0 | 6.21.0 |
| github.com | lxc_incus_v6 | >= 6.1.0 | — |
| linuxcontainers | incus | <= 6.0.5 | — |
| linuxcontainers | incus | >= 6.1.0 < 6.21.0 | 6.21.0 |
| lxc | incus | <= 6.0.5 | — |
| lxc | incus | — | — |
| lxc | incus | >= 0 < 6.0.4-2+deb13u4 | 6.0.4-2+deb13u4 |
| lxc | incus | >= 0 < 6.0.5-8 | 6.0.5-8 |
CVSS provenance
nvdv3.18.7HIGHCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
osv8.7HIGH
vendor_debian8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}
ghsa·2026-05-26
CVE-2026-33137 [CRITICAL] CWE-862 XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}
XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}
### Impact
`POST /wikis/{wikiName}` executes a XAR import without performing any authentication or authorization checks, allowing an unauthenticated attacker to create or update documents in the target wiki
### Patches
This vulnerability has been patched in XWiki 16.10.17, 17.4.9, 17.10.3, 18.0.1 and 18.1.0-rc-1.
### Workarounds
XWiki is not aware of any workarounds other than adding a rule into an HTTP proxy to prevent access POST request in the `/wikis/{wikiName}[/]` endpoint.
### Resources
* https://jira.xwiki.org/browse/XWIKI-23953
* https://github.com/xwiki/xwiki-platform/commit/4b7b95b79256374d487e9ece1dc48f527966990f
### For more information
If there are any questions or comments about this advisor
OSV
Incus container environment configuration newline injection in github.com/lxc/incus
osv·2026-02-05
CVE-2026-23953 Incus container environment configuration newline injection in github.com/lxc/incus
Incus container environment configuration newline injection in github.com/lxc/incus
Incus container environment configuration newline injection in github.com/lxc/incus
OSV
CVE-2026-23953: Incus is a system container and virtual machine manager
osv·2026-01-22·CVSS 8.7
CVE-2026-23953 [HIGH] CVE-2026-23953: Incus is a system container and virtual machine manager
Incus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch a container with a custom YAML configuration (e.g a member of the ‘incus’ group) can create an environment variable containing newlines, which can be used to add additional configuration items in the container’s lxc.conf due to newline injection. This can allow adding arbitrary lifecycle hooks, ultimately resulting in arbitrary command execution on the host. Exploiting this issue on IncusOS requires a slight modification of the payload to change to a different writable directory for the validation step (e.g /tmp). This can be confirmed with a second container with /tmp mounted from the host (A privileged action for validation only). A fix is planned for versions 6.0.6 an
GHSA
Incus container environment configuration newline injection
ghsa·2026-01-22
CVE-2026-23953 [HIGH] CWE-93 Incus container environment configuration newline injection
Incus container environment configuration newline injection
### Summary
A user with the ability to launch a container with a custom YAML configuration (e.g a member of the ‘incus’ group) can create an environment variable containing newlines, which can be used to add additional configuration items in the container’s `lxc.conf` due to the newline injection. This can allow adding arbitrary lifecycle hooks, ultimately resulting in arbitrary command execution on the host.
### Details
When passing environment variables in the config block of a new container, values are not checked for the presence of newlines [1], which can result in newline injection inside the generated container `lxc.conf`. This can be used to set arbitrary additional configuration items, such as `lxc.hook.pre-start`. By e
OSV
Incus container environment configuration newline injection
osv·2026-01-22
CVE-2026-23953 [HIGH] Incus container environment configuration newline injection
Incus container environment configuration newline injection
### Summary
A user with the ability to launch a container with a custom YAML configuration (e.g a member of the ‘incus’ group) can create an environment variable containing newlines, which can be used to add additional configuration items in the container’s `lxc.conf` due to the newline injection. This can allow adding arbitrary lifecycle hooks, ultimately resulting in arbitrary command execution on the host.
### Details
When passing environment variables in the config block of a new container, values are not checked for the presence of newlines [1], which can result in newline injection inside the generated container `lxc.conf`. This can be used to set arbitrary additional configuration items, such as `lxc.hook.pre-start`. By e
Debian
CVE-2026-23953: incus - Incus is a system container and virtual machine manager. In versions 6.20.0 and ...
vendor_debian·2026·CVSS 8.7
CVE-2026-23953 [HIGH] CVE-2026-23953: incus - Incus is a system container and virtual machine manager. In versions 6.20.0 and ...
Incus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch a container with a custom YAML configuration (e.g a member of the ‘incus’ group) can create an environment variable containing newlines, which can be used to add additional configuration items in the container’s lxc.conf due to newline injection. This can allow adding arbitrary lifecycle hooks, ultimately resulting in arbitrary command execution on the host. Exploiting this issue on IncusOS requires a slight modification of the payload to change to a different writable directory for the validation step (e.g /tmp). This can be confirmed with a second container with /tmp mounted from the host (A privileged action for validation only). A fix is planned for versions 6.0.6 an
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-23953 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.7
CVE-2026-23953 [HIGH] CVE-2026-23953 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-23953 :
Homebrew vulnerability analysis and mitigation
Incus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch a container with a custom YAML configuration (e.g a member of the ‘incus’ group) can create an environment variable containing newlines, which can be used to add additional configuration items in the container’s lxc.conf due to newline injection. This can allow adding arbitrary lifecycle hooks, ultimately resulting in arbitrary command execution on the host. Exploiting this issue on IncusOS requires a slight modification of the payload to change to a different writable directory for the validation step (e.g /tmp). This can be confirmed with a second container with /tmp mounted from the host (A privilege
Bugzilla
CVE-2026-23953 incus: container environment configuration newline injection [fedora-42]
bugzilla·2026-01-23·CVSS 8.7
CVE-2026-23953 [HIGH] CVE-2026-23953 incus: container environment configuration newline injection [fedora-42]
CVE-2026-23953 incus: container environment configuration newline injection [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-a9017d0297 (incus-6.23-1.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-a9017d0297
---
FEDORA-2026-a9017d0297 has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-a9017d0297`
You can provide feedback for this update here: https://bodhi.fedoraproject.or
Bugzilla
CVE-2026-23953 incus: container environment configuration newline injection [fedora-43]
bugzilla·2026-01-23·CVSS 8.7
CVE-2026-23953 [HIGH] CVE-2026-23953 incus: container environment configuration newline injection [fedora-43]
CVE-2026-23953 incus: container environment configuration newline injection [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-5af38b7ecb (incus-6.23-1.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-5af38b7ecb
---
FEDORA-2026-5af38b7ecb has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-5af38b7ecb`
You can provide feedback for this update here: https://bodhi.fedoraproject.or
https://github.com/lxc/incus/blob/HEAD/internal/server/instance/drivers/driver_lxc.go#L1081https://github.com/lxc/incus/security/advisories/GHSA-x6jc-phwx-hp32https://github.com/user-attachments/files/24473682/environment_newline_injection.shhttps://github.com/user-attachments/files/24473685/environment_newline_injection.patch
2026-01-22
Published