CVE-2026-33898
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedIncus is a system container and virtual machine manager. Prior to version 6.23.0, the web server spawned by `incus webui` incorrectly validates the authentication token such that an invalid value will be accepted. `incus webui` runs a local web server on a random localhost port. For authentication, it provides the user with a URL containing an authentication token. When accessed with that token, Incus creates a cookie persisting that token without needing to include it in subsequent HTTP requests. While the Incus client correctly validates the value of the cookie, it does not correctly validate the token when passed int the URL. This allows for an attacker able to locate and talk to the temporary web server on localhost to have as much access to Incus as the user who ran `incus webui`. This can lead to privilege escalation by another local user or an access to the user's Incus instances and possibly system resources by a remote attack able to trick the local user into interacting with the Incus UI web server. Version 6.23.0 patches the issue.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceIn Incus versions prior to 6.23.0, the web server spawned by `incus webui` fails to properly validate authentication tokens passed via URL parameters. While the client correctly validates persisted cookie values, it accepts any token value in the initial URL, allowing an attacker with localhost access to inherit the full privileges of the user who launched the web UI.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 6.23.0CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify installed Incus versionRun `incus version` or `incus admin info` to retrieve the running Incus version numberAffected if The version shown is below 6.23.0 (e.g., 6.22.0, 6.21.0, etc.)
-
Verify if webui is accessibleCheck for any process listening on localhost ports associated with the Incus web UI (typically port 8443 or 8080). Use `ss -tlnp | grep -E ':(8443|8080)'` or `ps aux | grep -i incus | grep -i webui`Affected if The Incus web UI is currently running and bound to localhost
-
Confirm local user access environmentReview system logs in /var/log/ for any unauthorized access attempts to localhost ports used by the Incus web UI, or check system user accounts with `grep '^%sudo\|^%wheel' /etc/group` to identify who has local shell accessAffected if Multiple users have shell access to the same system where incus webui runs, or the system is multi-user
-
Check for active webui sessionsExamine active network connections to localhost ports used by the Incus web UI using `ss -tn | grep -E ':(8443|8080)'` to see if connections exist beyond your ownAffected if There are connections from processes other than your own to the web UI port
You are affected if your Incus version is below 6.23.0 and the web UI is running in an environment where other users have localhost access.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped6.23.0
Upgrade Incus to version 6.23.0 or later. Until then, avoid running `incus webui` in multi-user or exposed environments where attackers could intercept the localhost connection.
Incus 6.23.0
- Check the currently installed Incus version using `incus --version` or your system's package manager
- Upgrade Incus to version 6.23.0 or later using your system's package manager or by obtaining the updated package from the official Incus distribution channels
- Verify the upgrade was successful by checking that the installed version is now 6.23.0 or higher
- If using `incus webui`, restart any running webui sessions to ensure the updated server component is used
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation2.0 h
- Implementation4.0 h
- Testing3.0 h
- Review / QA1.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,800.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-33898 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-33898 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data