CVE-2026-33945

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33945", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-24T19:50:52.105Z", "datePublished": "2026-03-26T23:27:45.711Z", "dateUpdated": "2026-03-27T20:00:08.359Z"}, "containers": {"cna": {"title": "Abitrary file write through systemd-creds option", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/lxc/incus/security/advisories/GHSA-q4q8-7f2j-9h9f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/lxc/incus/security/advisories/GHSA-q4q8-7f2j-9h9f"}], "affected": [{"vendor": "lxc", "product": "incus", "versions": [{"version": "< 6.23.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-26T23:27:45.711Z"}, "descriptions": [{"lang": "en", "value": "Incus is a system container and virtual machine manager. Incus instances have an option to provide credentials to systemd in the guest. For containers, this is handled through a shared directory. Prior to version 6.23.0, an attacker can set a configuration key named something like `systemd.credential.../../../../../../root/.bashrc` to cause Incus to write outside of the `credentials` directory associated with the container. This makes use of the fact that the Incus syntax for such credentials is `systemd.credential.XYZ` where `XYZ` can itself contain more periods. While it's not possible to read any data this way, it's possible to write to arbitrary files as root, enabling both privilege escalation and denial of service attacks. Version 6.23.0 fixes the issue."}], "source": {"advisory": "GHSA-q4q8-7f2j-9h9f", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-27T14:09:43.149002Z", "id": "CVE-2026-33945", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-27T20:00:08.359Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33945", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-27T14:09:43.149002Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-27T14:09:50.207Z"}}], "cna": {"title": "Abitrary file write through systemd-creds option", "source": {"advisory": "GHSA-q4q8-7f2j-9h9f", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "lxc", "product": "incus", "versions": [{"status": "affected", "version": "< 6.23.0"}]}], "references": [{"url": "https://github.com/lxc/incus/security/advisories/GHSA-q4q8-7f2j-9h9f", "name": "https://github.com/lxc/incus/security/advisories/GHSA-q4q8-7f2j-9h9f", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Incus is a system container and virtual machine manager. Incus instances have an option to provide credentials to systemd in the guest. For containers, this is handled through a shared directory. Prior to version 6.23.0, an attacker can set a configuration key named something like `systemd.credential.../../../../../../root/.bashrc` to cause Incus to write outside of the `credentials` directory associated with the container. This makes use of the fact that the Incus syntax for such credentials is `systemd.credential.XYZ` where `XYZ` can itself contain more periods. While it's not possible to read any data this way, it's possible to write to arbitrary files as root, enabling both privilege escalation and denial of service attacks. Version 6.23.0 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-26T23:27:45.711Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33945", "state": "PUBLISHED", "dateUpdated": "2026-03-27T20:00:08.359Z", "dateReserved": "2026-03-24T19:50:52.105Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-26T23:27:45.711Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "incus", "vendor": "lxc", "versions": [{"status": "affected", "version": "< 6.23.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "matchCriteriaId": "CBE3ABCB-1D47-4A45-A09A-C9F609C53131", "versionEndExcluding": "6.23.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Incus is a system container and virtual machine manager. Incus instances have an option to provide credentials to systemd in the guest. For containers, this is handled through a shared directory. Prior to version 6.23.0, an attacker can set a configuration key named something like `systemd.credential.../../../../../../root/.bashrc` to cause Incus to write outside of the `credentials` directory associated with the container. This makes use of the fact that the Incus syntax for such credentials is `systemd.credential.XYZ` where `XYZ` can itself contain more periods. While it's not possible to read any data this way, it's possible to write to arbitrary files as root, enabling both privilege escalation and denial of service attacks. Version 6.23.0 fixes the issue."}, {"lang": "es", "value": "Incus es un gestor de contenedores de sistema y de m\u00e1quinas virtuales. Las instancias de Incus tienen una opci\u00f3n para proporcionar credenciales a systemd en el invitado. Para los contenedores, esto se gestiona a trav\u00e9s de un directorio compartido. Antes de la versi\u00f3n 6.23.0, un atacante puede establecer una clave de configuraci\u00f3n con un nombre similar a systemd.credential.../../../../../../root/.bashrc para hacer que Incus escriba fuera del directorio 'credentials' asociado con el contenedor. Esto aprovecha el hecho de que la sintaxis de Incus para dichas credenciales es systemd.credential.XYZ, donde XYZ puede contener m\u00e1s puntos. Si bien no es posible leer ning\u00fan dato de esta manera, es posible escribir en archivos arbitrarios como root, lo que permite tanto la escalada de privilegios como los ataques de denegaci\u00f3n de servicio. La versi\u00f3n 6.23.0 corrige el problema."}], "id": "CVE-2026-33945", "lastModified": "2026-06-17T10:38:20.773", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 5.8, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33945", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-27T14:09:43.149002Z", "version": "2.0.3"}}]}, "published": "2026-03-27T00:16:23.633", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/lxc/incus/security/advisories/GHSA-q4q8-7f2j-9h9f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "incus: Incus: Privilege escalation and denial of service via path traversal in systemd credential configuration", "id": "2452054", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452054"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-22", "details": ["A flaw was found in Incus, a system container and virtual machine manager. An attacker with the ability to configure Incus instances can exploit a path traversal vulnerability by manipulating the `systemd.credential` configuration key. This allows the attacker to write to arbitrary files as the root user, leading to both privilege escalation and denial of service within the system."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-33945", "public_date": "2026-03-26T23:27:45Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-33945\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-33945\nhttps://github.com/lxc/incus/security/advisories/GHSA-q4q8-7f2j-9h9f"], "statement": "Critical: A path traversal vulnerability in Incus allows an attacker with the ability to configure Incus instances to write to arbitrary files as the root user. This can lead to privilege escalation and denial of service within the system. This issue affects Incus, which is available as a community project.", "threat_severity": "Critical"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.23.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "incus", "source": "cna", "vendor": "lxc"}, "product": "incus", "vendor": "lxc"}], "analysis": {"en": {"generated_at": "2026-04-02T04:13:40.041955+00:00", "value": {"mitigation_remediation": ["Upgrade Incus to version 6.23.0 or later, where the directory traversal check is fixed.", "If an upgrade is not feasible, disable the systemd credential feature or ensure that no credentials are supplied for containers.", "Restrict configuration changes to trusted administrators only to prevent malicious key injection.", "Verify that file write attempts outside the credentials directory are blocked by monitoring Incus logs."], "summary": {"action": "Patch Now", "impact": "Arbitrary root file write"}, "threat_synthesis": {"affected_systems": "Affected systems are deployments using the Linux Containers Incus container manager from the LXC project. Versions older than 6.23.0 are impacted; this includes all releases where the systemd credential syntax has been implemented without proper sanitization, such as 6.22.x and earlier. Any container or VM running under those versions is vulnerable if credentials are exposed.", "description_and_impact": "Incus, a system container and virtual machine manager, contains a configuration flaw that allows an attacker to supply a specially crafted credential key such as systemd.credential.XYZ to write outside the allowed credentials directory. By steering the key name to contain path-traversal fragments, the software opens the opportunity to write arbitrary files as root, leading to privilege escalation or denial of service. The vulnerability is a directory traversal/file write problem classified as CWE-22.", "risk_and_exploitability": "This issue has a CVSS score of 10 and an EPSS score of less than 1%, indicating a high severity but a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves the attacker having the ability to set or modify configuration for a container or virtual machine, for example via the Incus API or control interface, in order to inject a malicious credential key that traverses directories and writes to arbitrary files as root. No complete remote exploit path is disclosed, but the flaw provides local root-escapable write capabilities."}}}}, "created": "2026-03-27T08:31:24.945508+00:00", "updated": "2026-04-02T07:56:04.502160+00:00", "vendors": ["lxc", "lxc$PRODUCT$incus"]}