CVE-2026-33945
published 2026-03-27CVE-2026-33945: Incus is a system container and virtual machine manager. Incus instances have an option to provide credentials to systemd in the guest. For containers, this is…
PriorityP260critical9.6CVSS 3.1
AVNACLPRLUINSCCNIHAH
EPSS
0.45%
36.2th percentile
Incus is a system container and virtual machine manager. Incus instances have an option to provide credentials to systemd in the guest. For containers, this is handled through a shared directory. Prior to version 6.23.0, an attacker can set a configuration key named something like `systemd.credential.../../../../../../root/.bashrc` to cause Incus to write outside of the `credentials` directory associated with the container. This makes use of the fact that the Incus syntax for such credentials is `systemd.credential.XYZ` where `XYZ` can itself contain more periods. While it's not possible to read any data this way, it's possible to write to arbitrary files as root, enabling both privilege escalation and denial of service attacks. Version 6.23.0 fixes the issue.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | incus | < incus 6.0.6-2 (forky) | incus 6.0.6-2 (forky) |
| debian | lxd | < incus 6.0.6-2 (forky) | incus 6.0.6-2 (forky) |
| github.com | lxc_incus_v6 | >= 0 < 6.23.0 | 6.23.0 |
| linuxcontainers | incus | < 6.23.0 | 6.23.0 |
| lxc | incus | < 6.23.0 | 6.23.0 |
| lxc | incus | >= 0 < 6.0.6-2 | 6.0.6-2 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor Incus container configuration keys matching the pattern `systemd.credential.*` where the credential name (XYZ portion) contains path traversal sequences (e.g., `..`) — this is the attack vector for arbitrary file writes as root. ↗
- →Alert on any file write operations originating from the Incus credentials shared directory that resolve to paths outside of the container's designated `credentials` directory, particularly targeting sensitive root-owned files. ↗
- →Audit Incus instance configuration for `systemd.credential` keys whose XYZ suffix contains period-separated path components that include `..` traversal sequences, as the Incus syntax allows XYZ itself to contain periods. ↗
- ·Vulnerability is local-scope only — the attacker must already have the ability to configure Incus instances (set configuration keys) to exploit this path traversal. Remote exploitation is not possible without prior access. ↗
- ·The vulnerability only allows arbitrary file *writes* as root, not reads — data exfiltration via this vector is not possible, but privilege escalation and DoS are. ↗
- ·This vulnerability affects containers only (not VMs), as the systemd credential sharing for VMs uses a different mechanism than the shared directory used for containers. ↗
CVSS provenance
nvdv3.19.6CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
osv9.6CRITICAL
vendor_debian9.9CRITICAL
vendor_redhat9.9CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus
osv·2026-04-07
CVE-2026-33945 Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus
Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus
Incus has an abitrary file write through its systemd-creds options in github.com/lxc/incus
GHSA
Incus has an abitrary file write through its systemd-creds options
ghsa·2026-03-27
CVE-2026-33945 [CRITICAL] CWE-22 Incus has an abitrary file write through its systemd-creds options
Incus has an abitrary file write through its systemd-creds options
### Summary
Incus instances have an option to provide credentials to systemd in the guest. For containers, this is handled through a shared directory.
An attacker can use the name of a systemd credential to escape that directory and overwrite arbitrary files on the host system.
This can in turn be used to perform local privilege escalation or cause a DoS.
### Details
An attacker can set a configuration key named something like `systemd.credential.../../../../../../root/.bashrc` to cause Incus to write outside of the `credentials` directory associated with the container. This makes use of the fact that the Incus syntax for such credentials is `systemd.credential.XYZ` where `XYZ` can itself contain more periods.
While it'
OSV
Incus has an abitrary file write through its systemd-creds options
osv·2026-03-27
CVE-2026-33945 [CRITICAL] Incus has an abitrary file write through its systemd-creds options
Incus has an abitrary file write through its systemd-creds options
### Summary
Incus instances have an option to provide credentials to systemd in the guest. For containers, this is handled through a shared directory.
An attacker can use the name of a systemd credential to escape that directory and overwrite arbitrary files on the host system.
This can in turn be used to perform local privilege escalation or cause a DoS.
### Details
An attacker can set a configuration key named something like `systemd.credential.../../../../../../root/.bashrc` to cause Incus to write outside of the `credentials` directory associated with the container. This makes use of the fact that the Incus syntax for such credentials is `systemd.credential.XYZ` where `XYZ` can itself contain more periods.
While it'
OSV
CVE-2026-33945: Incus is a system container and virtual machine manager
osv·2026-03-27·CVSS 9.6
CVE-2026-33945 [CRITICAL] CVE-2026-33945: Incus is a system container and virtual machine manager
Incus is a system container and virtual machine manager. Incus instances have an option to provide credentials to systemd in the guest. For containers, this is handled through a shared directory. Prior to version 6.23.0, an attacker can set a configuration key named something like `systemd.credential.../../../../../../root/.bashrc` to cause Incus to write outside of the `credentials` directory associated with the container. This makes use of the fact that the Incus syntax for such credentials is `systemd.credential.XYZ` where `XYZ` can itself contain more periods. While it's not possible to read any data this way, it's possible to write to arbitrary files as root, enabling both privilege escalation and denial of service attacks. Version 6.23.0 fixes the issue.
Red Hat
incus: Incus: Privilege escalation and denial of service via path traversal in systemd credential configuration
vendor_redhat·2026-03-26·CVSS 9.9
CVE-2026-33945 [CRITICAL] CWE-22 incus: Incus: Privilege escalation and denial of service via path traversal in systemd credential configuration
incus: Incus: Privilege escalation and denial of service via path traversal in systemd credential configuration
Incus is a system container and virtual machine manager. Incus instances have an option to provide credentials to systemd in the guest. For containers, this is handled through a shared directory. Prior to version 6.23.0, an attacker can set a configuration key named something like `systemd.credential.../../../../../../root/.bashrc` to cause Incus to write outside of the `credentials` directory associated with the container. This makes use of the fact that the Incus syntax for such credentials is `systemd.credential.XYZ` where `XYZ` can itself contain more periods. While it's not possible to read any data this way, it's possible to write to arbitrary files as root, enabling both
Debian
CVE-2026-33945: incus - Incus is a system container and virtual machine manager. Incus instances have an...
vendor_debian·2026·CVSS 9.9
CVE-2026-33945 [CRITICAL] CVE-2026-33945: incus - Incus is a system container and virtual machine manager. Incus instances have an...
Incus is a system container and virtual machine manager. Incus instances have an option to provide credentials to systemd in the guest. For containers, this is handled through a shared directory. Prior to version 6.23.0, an attacker can set a configuration key named something like `systemd.credential.../../../../../../root/.bashrc` to cause Incus to write outside of the `credentials` directory associated with the container. This makes use of the fact that the Incus syntax for such credentials is `systemd.credential.XYZ` where `XYZ` can itself contain more periods. While it's not possible to read any data this way, it's possible to write to arbitrary files as root, enabling both privilege escalation and denial of service attacks. Version 6.23.0 fixes the issue.
Scope: local
forky: resolved
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-33945 incus: Incus: Privilege escalation and denial of service via path traversal in systemd credential configuration [fedora-all]
bugzilla·2026-03-27·CVSS 9.9
CVE-2026-33945 [CRITICAL] CVE-2026-33945 incus: Incus: Privilege escalation and denial of service via path traversal in systemd credential configuration [fedora-all]
CVE-2026-33945 incus: Incus: Privilege escalation and denial of service via path traversal in systemd credential configuration [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-5af38b7ecb (incus-6.23-1.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-5af38b7ecb
---
FEDORA-2026-5af38b7ecb has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-5af38b7ecb`
You can provide feedback
Wiz
CVE-2026-33945 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 9.9
CVE-2026-33945 [CRITICAL] CVE-2026-33945 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-33945 :
Homebrew vulnerability analysis and mitigation
systemd.credential.../../../../../../root/.bashrc
credentials
systemd.credential.XYZ
XYZ
Source : NVD
## 9.6
Score
Published March 27, 2026
Severity CRITICAL
CNA Score 9.9
Affected Technologies
Homebrew
Linux Debian
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 21.2
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
incus
lxd
Sources
NVD
Debian 12, 13 Severity CRITICAL No Fix Added at: Mar 29, 2026
Debian 14 Severity CRITICAL Has Fix Added at: Mar 29, 2026
Echo Severity CRITICAL No Fix Added at: Mar 29, 2026
GoLang Severity CRITICAL Has Fix Added at: Mar 29, 2026
Homebrew Severity CRITI
2026-03-27
Published