CVE-2026-23953: Incus Container Manager RCE Vulnerability

CVE-2026-23953 Overview

CVE-2026-23953 is a newline injection vulnerability in Incus, a system container and virtual machine manager. The vulnerability exists in versions 6.20.0 and below, where a user with the ability to launch a container with a custom YAML configuration (e.g., a member of the incus group) can create an environment variable containing newlines. This can be exploited to inject additional configuration items into the container's lxc.conf file, allowing attackers to add arbitrary lifecycle hooks that ultimately result in arbitrary command execution on the host system.

Critical Impact

This vulnerability enables container escape through newline injection in environment variables, potentially allowing full host compromise from a low-privileged container user context.

Affected Products

• Incus versions 6.20.0 and below
• IncusOS (requires modified payload targeting writable directories like /tmp)

Discovery Timeline

• 2026-01-22 - CVE CVE-2026-23953 published to NVD
• 2026-01-22 - Last updated in NVD database

Technical Details for CVE-2026-23953

Vulnerability Analysis

This vulnerability is classified as CWE-93 (Improper Neutralization of CRLF Sequences), commonly known as CRLF or newline injection. The flaw resides in how Incus processes environment variables when generating LXC configuration files for containers. When a user specifies environment variables in a custom YAML configuration, the values are not properly sanitized for newline characters before being written to the container's lxc.conf file.

The attack is particularly concerning because it requires only local access with membership in the incus group, which is a common permission granted to users who need to manage containers. The adjacent network attack vector indicates that exploitation can occur from systems on the same network segment with authenticated access.

Root Cause

The root cause lies in insufficient input validation within the LXC driver code, specifically in the handling of environment variable values during container configuration generation. The vulnerable code path can be found in the LXC driver implementation. When environment variables containing newline characters are processed, the newlines are preserved and written directly to the lxc.conf file, allowing attackers to inject arbitrary LXC configuration directives.

Attack Vector

The attack leverages the adjacent network vector and requires low privileges (membership in the incus group). An attacker crafts a container configuration with environment variables containing embedded newlines. These newlines break out of the environment variable context in the generated lxc.conf file, allowing the attacker to inject malicious LXC configuration directives.

By injecting lifecycle hook directives (such as lxc.hook.pre-start or lxc.hook.post-stop), the attacker can specify arbitrary commands that execute on the host system when the container transitions through those lifecycle states. On IncusOS, the attack requires targeting a writable directory such as /tmp for the validation step.

The exploitation flow involves:

1. Creating a malicious environment variable value with embedded newlines
2. Including LXC lifecycle hook configuration after the newline characters
3. Launching or restarting the container to trigger hook execution
4. Achieving arbitrary command execution on the host with the privileges of the Incus daemon

Detection Methods for CVE-2026-23953

Indicators of Compromise

• Unusual or unexpected lxc.hook.* entries in container configuration files under the Incus data directory
• Environment variables in container YAML configurations containing newline characters (\n, %0a, or literal line breaks)
• Unexpected script execution or process spawning by the Incus daemon process
• Container configurations referencing writable host directories like /tmp in hook commands

Detection Strategies

• Monitor container configuration files for the presence of lifecycle hook directives that were not explicitly configured through normal administrative channels
• Implement audit logging for all container creation and modification operations, flagging configurations with multi-line environment variable values
• Deploy file integrity monitoring on Incus configuration directories to detect unauthorized modifications
• Use process monitoring to detect child processes spawned by the Incus daemon that match known exploitation patterns

Monitoring Recommendations

• Enable verbose logging in Incus to capture full container configuration details during creation and modification events
• Configure SIEM rules to alert on container configurations containing embedded newlines or suspicious LXC directives
• Monitor for privilege escalation attempts from users in the incus group
• Review audit logs for container lifecycle events that coincide with unexpected host-level command execution

How to Mitigate CVE-2026-23953

Immediate Actions Required

• Restrict membership in the incus group to only trusted administrators who require container management capabilities
• Audit existing container configurations for malicious or unexpected environment variable values containing newlines
• Implement additional access controls to limit who can create containers with custom YAML configurations
• Consider running Incus containers in more restricted modes until patches are applied

Patch Information

A fix is planned for Incus versions 6.0.6 and 6.21.0, though these versions had not been released at the time of CVE publication. Organizations should monitor the GitHub Security Advisory for release announcements and apply the update immediately upon availability. A preliminary patch has been made available through the security advisory for organizations that need to apply a fix before official releases.

Workarounds

• Remove untrusted users from the incus group to prevent exploitation by low-privileged attackers
• Implement a pre-validation script that scans container configurations for newline characters in environment variable values before allowing container creation
• Deploy AppArmor or SELinux policies to restrict what lifecycle hooks can execute, limiting the impact of successful exploitation
• Use network segmentation to limit adjacent network access to Incus management interfaces

# Example: Audit incus group membership and review container configurations
# List all users in the incus group
getent group incus

# Search for containers with potentially malicious environment variables
find /var/lib/incus/containers -name "*.yaml" -exec grep -l $'\n' {} \;

# Review LXC configuration files for unexpected hook directives
grep -r "lxc.hook" /var/lib/incus/containers/*/config