Attack Chain

1. Attacker identifies an Incus instance running a version prior to 6.23.0.
2. The attacker gains access to the Incus instance, potentially through existing vulnerabilities or compromised credentials.
3. Attacker crafts a malicious configuration key using the systemd.credential.XYZ syntax, embedding path traversal sequences (e.g., systemd.credential.../../../../../../root/.bashrc).
4. The attacker sets the crafted configuration key within the Incus instance's configuration.
5. Incus attempts to write the systemd credential data to the specified path, which, due to the path traversal, resolves to an arbitrary location on the host filesystem.
6. The attacker overwrites a critical system file (e.g., .bashrc, /etc/passwd) with malicious content, leveraging root privileges.
7. The attacker triggers the execution of the overwritten file (e.g., by logging in as root, starting a new shell, or restarting a service).
8. The attacker gains escalated privileges or causes a denial of service.

Impact

Successful exploitation of CVE-2026-33945 allows attackers to gain root privileges on the Incus host system. This can lead to complete system compromise, including data theft, modification, or destruction. Furthermore, attackers can leverage this vulnerability to cause a denial of service by overwriting critical system files. The severity is high due to the ease of exploitation and the potential for significant impact on affected systems. While there is no public report on the number of victims, any organization using vulnerable versions of Incus is potentially at risk.

Recommendation

• Upgrade Incus to version 6.23.0 or later to patch CVE-2026-33945.
• Implement filesystem monitoring for unexpected writes to sensitive system directories (e.g., /root, /etc) to detect potential exploitation attempts. Deploy the provided Sigma rule to detect suspicious file modifications.
• Enable audit logging on Incus configuration files to monitor for unauthorized changes. Deploy the provided Sigma rule to detect unauthorized changes to incus configuration files.