Skip to content
Threat Feed
critical advisory

Incus Instance Template Vulnerability CVE-2026-33897

A vulnerability in Incus versions prior to 6.23.0 allows for arbitrary read and write access as root on the host server by exploiting a missing chroot isolation in the pongo2 template engine.

Incus, a system container and virtual machine manager, is vulnerable to arbitrary read and write access as root due to a flaw in its instance template handling. Prior to version 6.23.0, the application lacks proper chroot isolation when processing pongo2 templates. These templates, intended for file templating within instances during their lifecycle, bypass the expected chroot, granting access to the entire host filesystem with root privileges. This vulnerability, identified as CVE-2026-33897…

Detection coverage 3

Detect Incus Instance Template Creation

low

Detects the creation of new Incus instance templates, which could be a precursor to exploiting CVE-2026-33897.

sigma tactics: privilege_escalation techniques: T1068 sources: file_event, linux

Detect Incus Pongo2 Template File Modification

medium

Detects modification of Incus template files containing pongo2 code, potentially indicating exploitation of CVE-2026-33897.

sigma tactics: privilege_escalation techniques: T1068 sources: file_event, linux

Detect Incus Template Execution with File Access Outside Instance

high

Detects file access attempts outside the expected chroot of an Incus instance during template execution.

sigma tactics: privilege_escalation techniques: T1068 sources: file_event, linux

Detection queries are kept inside the platform. Get full rules →