CVE-2026-33542
published 2026-03-26CVE-2026-33542: Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from…
PriorityP424medium4.8CVSS 3.1
AVNACHPRNUINSUCLILAN
EPSS
0.18%
7.6th percentile
Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from simplestreams image servers opens the door to image cache poisoning and under very narrow circumstances exposes other tenants to running attacker controlled images rather than the expected one. Version 6.23.0 patches the issue.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | lxd | >= 0 < 5.0.2-5+deb12u4 | 5.0.2-5+deb12u4 |
| canonical | lxd | >= 0 < 5.0.2+git20231211.1364ae4-9+deb13u4 | 5.0.2+git20231211.1364ae4-9+deb13u4 |
| debian | incus | < incus 6.0.6-2 (forky) | incus 6.0.6-2 (forky) |
| debian | lxd | < incus 6.0.6-2 (forky) | incus 6.0.6-2 (forky) |
| github.com | lxc_incus_v6 | >= 0 < 6.23.0 | 6.23.0 |
| github.com | lxc_incus_v6_client | >= 0 < 6.23.0 | 6.23.0 |
| linuxcontainers | incus | < 6.23.0 | 6.23.0 |
| lxc | incus | < 6.23.0 | 6.23.0 |
| lxc | incus | >= 0 < 6.0.4-2+deb13u5 | 6.0.4-2+deb13u5 |
| lxc | incus | >= 0 < 6.0.6-2 | 6.0.6-2 |
CVSS provenance
nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
nvdv4.05.7MEDIUMCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv5.7MEDIUM
vendor_debian5.7MEDIUM
vendor_redhat5.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
github.com/lxc/incus: Incus: Image cache poisoning due to insufficient image fingerprint validation
vendor_redhat·2026-03-26·CVSS 5.7
CVE-2026-33542 [MEDIUM] CWE-354 github.com/lxc/incus: Incus: Image cache poisoning due to insufficient image fingerprint validation
github.com/lxc/incus: Incus: Image cache poisoning due to insufficient image fingerprint validation
Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from simplestreams image servers opens the door to image cache poisoning and under very narrow circumstances exposes other tenants to running attacker controlled images rather than the expected one. Version 6.23.0 patches the issue.
A flaw was found in Incus, a system container and virtual machine manager. A remote attacker could exploit a lack of validation of image fingerprints when downloading from simplestreams image servers. This vulnerability, under specific conditions, could lead to image cache poisoning, allowing an attacker to expose othe
Debian
CVE-2026-33542: incus - Incus is a system container and virtual machine manager. Prior to version 6.23.0...
vendor_debian·2026·CVSS 5.7
CVE-2026-33542 [MEDIUM] CVE-2026-33542: incus - Incus is a system container and virtual machine manager. Prior to version 6.23.0...
Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from simplestreams image servers opens the door to image cache poisoning and under very narrow circumstances exposes other tenants to running attacker controlled images rather than the expected one. Version 6.23.0 patches the issue.
Scope: local
forky: resolved (fixed in 6.0.6-2)
sid: resolved (fixed in 6.0.6-2)
trixie: resolved (fixed in 6.0.4-2+deb13u5)
OSV
Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus
osv·2026-04-07
CVE-2026-33542 Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus
Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus
Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus
GHSA
Incus does not verify combined fingerprint when downloading images from simplestreams servers
ghsa·2026-03-27
CVE-2026-33542 [HIGH] CWE-295 Incus does not verify combined fingerprint when downloading images from simplestreams servers
Incus does not verify combined fingerprint when downloading images from simplestreams servers
### Summary
A lack of validation of the image fingerprint when downloading from simplestreams image servers opens the door to image cache poisoning and under very narrow circumstances exposes other tenants to running attacker controlled images rather than the expected one.
### Details
Incus image fingerprints are computed as the SHA256 of the concatenated image files.
When downloading from a public image server using a simplestreams index, Incus requires an HTTPS connection and validates the SHA256 of the individual files but is lacking validation that the concatenated hash of the files matches the fingerprint listed in the simplestreams index.
This missing check allows an attacker with access
OSV
Incus does not verify combined fingerprint when downloading images from simplestreams servers
osv·2026-03-27
CVE-2026-33542 [HIGH] Incus does not verify combined fingerprint when downloading images from simplestreams servers
Incus does not verify combined fingerprint when downloading images from simplestreams servers
### Summary
A lack of validation of the image fingerprint when downloading from simplestreams image servers opens the door to image cache poisoning and under very narrow circumstances exposes other tenants to running attacker controlled images rather than the expected one.
### Details
Incus image fingerprints are computed as the SHA256 of the concatenated image files.
When downloading from a public image server using a simplestreams index, Incus requires an HTTPS connection and validates the SHA256 of the individual files but is lacking validation that the concatenated hash of the files matches the fingerprint listed in the simplestreams index.
This missing check allows an attacker with access
OSV
CVE-2026-33542: Incus is a system container and virtual machine manager
osv·2026-03-26·CVSS 5.7
CVE-2026-33542 [MEDIUM] CVE-2026-33542: Incus is a system container and virtual machine manager
Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from simplestreams image servers opens the door to image cache poisoning and under very narrow circumstances exposes other tenants to running attacker controlled images rather than the expected one. Version 6.23.0 patches the issue.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-33542 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.7
CVE-2026-33542 [MEDIUM] CVE-2026-33542 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-33542 :
Homebrew vulnerability analysis and mitigation
Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from simplestreams image servers opens the door to image cache poisoning and under very narrow circumstances exposes other tenants to running attacker controlled images rather than the expected one. Version 6.23.0 patches the issue.
Source : NVD
## 5.7
Score
Published March 26, 2026
Severity MEDIUM
CNA Score 5.7
Affected Technologies
Homebrew
Linux Debian
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 10.7
Exploitation Probability (EPSS) N/A
Affected packages and libraries
Bugzilla
CVE-2026-33542 incus: Incus: Image cache poisoning due to insufficient image fingerprint validation [fedora-42]
bugzilla·2026-03-26·CVSS 5.7
CVE-2026-33542 [MEDIUM] CVE-2026-33542 incus: Incus: Image cache poisoning due to insufficient image fingerprint validation [fedora-42]
CVE-2026-33542 incus: Incus: Image cache poisoning due to insufficient image fingerprint validation [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-a9017d0297 (incus-6.23-1.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-a9017d0297
---
FEDORA-2026-a9017d0297 has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-a9017d0297`
You can provide feedback for this update here: https:
Bugzilla
CVE-2026-33542 incus: Incus: Image cache poisoning due to insufficient image fingerprint validation [fedora-43]
bugzilla·2026-03-26·CVSS 5.7
CVE-2026-33542 [MEDIUM] CVE-2026-33542 incus: Incus: Image cache poisoning due to insufficient image fingerprint validation [fedora-43]
CVE-2026-33542 incus: Incus: Image cache poisoning due to insufficient image fingerprint validation [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-5af38b7ecb (incus-6.23-1.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-5af38b7ecb
---
FEDORA-2026-5af38b7ecb has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-5af38b7ecb`
You can provide feedback for this update here: https:
2026-03-26
Published