CVE-2026-33897 Overview
CVE-2026-33897 is a critical vulnerability in Incus, a system container and virtual machine manager maintained by the Linux Containers project. The flaw resides in how Incus integrates the pongo2 templating engine to process instance template files. Attackers with the ability to supply or modify instance templates can read and write arbitrary files on the host server with root privileges. The pongo2 chroot isolation that was expected to confine template operations to the instance filesystem is bypassed entirely. Version 6.23.0 patches the issue.
Critical Impact
Authenticated attackers can break out of the instance template sandbox and perform arbitrary read or write operations on the host filesystem as root, leading to full host compromise.
Affected Products
- Linuxcontainers Incus versions prior to 6.23.0
- Deployments using pongo2 instance template files
- Multi-tenant Incus hosts where untrusted users can supply instance templates
Discovery Timeline
- 2026-03-26 - CVE-2026-33897 published to NVD
- 2026-03-30 - Last updated in NVD database
Technical Details for CVE-2026-33897
Vulnerability Analysis
Incus uses pongo2 templates to render files inside instances at various points in the instance lifecycle. The templating implementation exposes file read and write filters so a template can, for example, read a configuration file and emit a modified version. The Incus design assumed that the pongo2 chroot feature would confine these operations to the instance's root filesystem. The chroot mechanism is not enforced at runtime, so template file operations resolve against the host's filesystem instead of the instance's. Because the Incus daemon runs as root, the resulting reads and writes execute with full host privileges. This issue is categorized under [CWE-1336] (Improper Neutralization of Special Elements Used in a Template Engine).
Root Cause
The root cause is a missing isolation boundary between the templating engine and the host. Incus delegates path resolution to pongo2, expecting the engine's chroot option to restrict access. The chroot is skipped during template evaluation, so absolute paths and traversal sequences resolve directly on the host filesystem.
Attack Vector
An attacker who controls instance template content supplies a template containing file read or write directives that target host paths such as /etc/shadow, /root/.ssh/authorized_keys, or systemd unit files under /etc/systemd/system/. When Incus renders the template during instance lifecycle events, the daemon performs the file operation as root on the host. This yields credential theft, persistence, and arbitrary code execution on the underlying server. The vulnerability is described in detail in the Incus GitHub Security Advisory GHSA-83xr-5xxr-mh92.
Detection Methods for CVE-2026-33897
Indicators of Compromise
- Instance template files containing absolute host paths or .. traversal sequences passed to pongo2 read or write filters
- Unexpected modifications to sensitive host files such as /etc/passwd, /etc/shadow, /root/.ssh/authorized_keys, or cron directories made by the Incus daemon process
- New or altered systemd units, PAM modules, or LD_PRELOAD configurations on Incus hosts
Detection Strategies
- Audit templates/ directories in all instance configurations for file operations referencing paths outside the instance rootfs
- Inspect Incus daemon logs for template rendering errors or unexpected file access during instance start, stop, or rebuild events
- Enable Linux audit rules (auditd) to log writes to sensitive host paths by the Incus daemon UID
Monitoring Recommendations
- Monitor process lineage for the incusd daemon performing file I/O on paths outside /var/lib/incus/
- Alert on creation or modification of authorized_keys, sudoers, and systemd unit files attributed to the Incus service
- Track Incus version inventory and flag hosts running releases prior to 6.23.0
How to Mitigate CVE-2026-33897
Immediate Actions Required
- Upgrade all Incus installations to version 6.23.0 or later
- Restrict who can create, modify, or upload instance templates to trusted administrators only
- Review existing instance templates for unexpected file read or write directives and remove untrusted templates
Patch Information
The Linux Containers project released Incus 6.23.0 to remediate the chroot bypass. The fix and full advisory are documented in the Incus GitHub Security Advisory GHSA-83xr-5xxr-mh92. Administrators should upgrade through their distribution package manager or the official Incus repositories and restart the daemon after applying the update.
Workarounds
- Disable or remove instance templates that are not strictly required until the upgrade is applied
- Limit Incus API and socket access to administrators using project-level role-based access controls
- Run Incus hosts with mandatory access controls such as AppArmor or SELinux policies that constrain daemon access to sensitive host paths
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.