CVE-2026-33897 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-33897 requires immediate attention.

· 3 min read

```html

Executive Summary

A critical vulnerability, CVE-2026-33897, has been identified in the Incus project, affecting both github.com/lxc/incus/v6 and github.com/lxc/incus. This flaw allows unauthenticated users to perform arbitrary read and write operations on the host server's filesystem with root privileges, due to a failure in the chroot isolation mechanism of the pongo2 templating engine. Immediate action is required to mitigate potential risks.

Immediate Action

  • Upgrade to patched versions of Incus as soon as available.
  • Isolate any services using Incus to limit exposure until patches are applied.
  • Monitor your systems for any unusual file access or changes.
  • Review your instance template configurations to ensure no sensitive files are accessible.
  • Stay tuned for official vendor advisories for further updates.

Affected Versions

  • github.com/lxc/incus@<=6.x.x vulnerable; upgrade to 6.x.y+
  • github.com/lxc/incus/v6@<=6.x.x vulnerable; upgrade to 6.x.y+

Resolution Guide

To resolve the vulnerability, follow these steps:

go get github.com/lxc/incus@6.x.y

Replace 6.x.y with the latest patched version once available.

For hardening your configuration, consider disabling the pongo2 templating feature if it's not required:

disable_pongo2_template=true

Example code fix snippet:

if !chrootIsolationEnabled {
    log.Fatal("Chroot isolation is not enabled, which poses a security risk.")
}

Detection & Verification

To check if your version of Incus is vulnerable, run:

go list -m all | grep github.com/lxc/incus

Verify the fix by ensuring the version is updated:

go list -m github.com/lxc/incus

Look for the version number to confirm it is above 6.x.x.

Risk and Impact

If exploited, this vulnerability could allow attackers to gain full root access to the host server, potentially leading to data breaches, unauthorized changes to system configurations, and complete control over the affected systems. The blast radius includes any application or service relying on the compromised templates, making it critical for solo developers and small teams to act swiftly.

```

Keep reading