CVE-2026-33897: 
NixOS vulnerability analysis and mitigation

CVE-2026-33897 is a critical arbitrary file read/write vulnerability in Incus, a system container and virtual machine manager, caused by a pongo2 template engine chroot isolation bypass. Discovered and reported by the security team at 7asecurity, it was publicly disclosed on March 26, 2026. All Incus versions prior to 6.23.0 are affected (including github.com/lxc/incus ≤ 0.7.0 and github.com/lxc/incus/v6 < 6.23.0). It carries a CVSS v3.1 base score of 9.9 (Critical) (GitHub Advisory, GHSA).

The root cause is a failure in the pongo2 template engine's chroot isolation mechanism (CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine; CWE-243: Creation of chroot Jail Without Changing Working Directory). Incus uses pongo2 templates within instances to generate or modify files during the instance lifecycle, relying on pongo2's chroot feature to restrict file access to the instance's own filesystem. However, pongo2 entirely skips the chroot isolation, meaning any file read or write operation within a template executes with root privileges against the full host filesystem rather than being sandboxed to the instance. An attacker with low-privilege access to an Incus instance can craft malicious template files to exploit this bypass over the network without user interaction (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows a low-privileged attacker to perform arbitrary file reads and writes as root on the Incus host server, completely breaking the container/VM isolation boundary. An attacker could read sensitive host files (e.g., /etc/shadow, SSH private keys, secrets), overwrite critical system files to achieve persistent access or privilege escalation, and potentially compromise the entire container and virtual machine infrastructure hosted on the affected system. The changed scope (S:C) in the CVSS vector reflects that the impact extends beyond the instance to the underlying host, enabling full host compromise and lateral movement to other hosted workloads (GitHub Advisory, GHSA).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (Feedly). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.029% (9th percentile), indicating a low near-term exploitation probability. However, the low attack complexity and minimal privilege requirement (only low-level instance access needed) make this an attractive target if exploitation details become public (GHSA).

1. Gain instance access: Obtain low-privileged access to an Incus instance on a vulnerable host (Incus < 6.23.0), either through legitimate credentials or by compromising an existing instance user account.
2. Identify template support: Confirm that the target instance has pongo2 template functionality enabled, which is used during instance lifecycle events (e.g., on start, on stop, on create).
3. Craft malicious template: Create or modify an instance template file to include pongo2 directives that read from or write to arbitrary host filesystem paths (e.g., reading /etc/shadow or writing an SSH authorized key to /root/.ssh/authorized_keys on the host).
4. Trigger template execution: Trigger the relevant instance lifecycle event (e.g., start or restart the instance) to cause Incus to process the malicious template file via pongo2.
5. Achieve host compromise: Because pongo2 skips chroot isolation, the template executes file operations as root against the full host filesystem, granting the attacker read access to sensitive files or write access to establish persistence or escalate privileges on the host (GitHub Advisory, Red Hat Bugzilla).

• File System: Unexpected modifications to host-level files (e.g., /root/.ssh/authorized_keys, /etc/passwd, /etc/cron.d/) with timestamps correlating to instance lifecycle events; new or modified files in sensitive host directories owned by root but originating from instance template processing.
• Logs: Incus daemon logs (/var/log/incus/ or journalctl -u incus) showing template execution events followed by unusual file access patterns outside the instance root; audit logs recording root-level file reads/writes during instance start/stop events.
• Process: Unexpected file I/O by the incusd process to paths outside the instance filesystem root during template rendering phases.
• Network: Unusual outbound connections from the Incus host following instance lifecycle events, potentially indicating post-exploitation activity such as reverse shell establishment or data exfiltration.

The official fix is to upgrade Incus to version 6.23.0 or later, which patches the pongo2 chroot isolation bypass (GitHub Advisory). As an interim workaround, restrict instance access strictly to trusted users and audit all existing instance template files for suspicious pongo2 directives that reference paths outside the instance filesystem. Additionally, limit network access to Incus hosts and consider disabling template functionality where not required until patching is complete (Feedly). OpenSUSE and Fedora have also issued security updates for their packaged versions of Incus.

The vulnerability was discovered and responsibly disclosed by the team at 7asecurity, with credit given to researcher grmpyninja as the finder and Incus maintainer stgraber as the remediation developer (GitHub Advisory). The issue was tracked by Red Hat's Product Security team via Bugzilla and flagged as high severity. OpenSUSE issued a security announcement, and downstream distributions including Debian and Fedora published updates. Community coverage appeared on platforms including Bluesky and security news aggregators shortly after disclosure.