CVE-2026-33898: 
NixOS vulnerability analysis and mitigation

CVE-2026-33898 is an authentication bypass vulnerability in the Incus system container and virtual machine manager, specifically affecting the local web server spawned by the incus webui command. The flaw allows an attacker who can reach the temporary localhost web server to gain full access to Incus without valid credentials. All versions of Incus prior to 6.23.0 are affected. Disclosed on March 26–27, 2026, the vulnerability carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper authentication (CWE-287) combined with an incorrect implementation of the authentication algorithm (CWE-303): the incus webui local web server validates the authentication token correctly when it is stored as a cookie, but fails to properly validate the token when it is supplied directly in the URL query string — accepting any value, including invalid ones. An attacker can exploit this by crafting a request to the random localhost port where the web server is listening, supplying an arbitrary token value in the URL to bypass authentication entirely. The vulnerability was discovered and reported by the team at 7asecurity (GitHub Security Advisory).

Successful exploitation grants an attacker the same level of access to Incus as the user who launched incus webui, enabling full control over system containers and virtual machines. This can result in local privilege escalation by another user on the same host, unauthorized access to the victim's Incus instances, and potential compromise of underlying system resources. A remote attacker could also achieve this by tricking the local user into clicking a crafted link that causes their browser to interact with the local Incus web server, leading to high confidentiality, integrity, and availability impact (GitHub Security Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.028% (9th percentile), indicating a low near-term exploitation probability. Exploitation requires either local network access to the random localhost port or the ability to socially engineer the target user into visiting a crafted URL.

1. Reconnaissance: Identify a target system running Incus with an active incus webui session. Scan localhost ports (e.g., using ss -tlnp or netstat -tlnp if local access is available, or via a browser-based port scan if exploiting remotely via social engineering) to locate the random port the web server is listening on.
2. Craft malicious URL: Construct a URL targeting the identified localhost port with an arbitrary (invalid) authentication token in the query string, e.g., http://127.0.0.1:<PORT>/?token=INVALID_TOKEN.
3. Deliver or access the URL: If exploiting locally, directly access the crafted URL. If exploiting remotely, trick the target user into clicking the crafted link (e.g., via phishing), causing their browser to send the request to the local Incus web server.
4. Bypass authentication: The server accepts the invalid token and sets an authentication cookie, granting full access to the Incus web UI without requiring valid credentials.
5. Achieve objective: Use the authenticated Incus web UI session to manage containers and VMs, escalate privileges, exfiltrate data, or manipulate system resources with the same permissions as the user who ran incus webui (GitHub Security Advisory).

• Network: Unexpected HTTP requests to the random localhost port used by incus webui originating from processes other than the user's own browser; browser-initiated requests to 127.0.0.1 on unusual high ports with arbitrary token query parameters.
• Logs: Web server access logs for the incus webui process showing authentication attempts with invalid or unexpected token values that result in successful session establishment; repeated access from unexpected local users or processes.
• Process: Unexpected processes or users interacting with the Incus API or managing containers/VMs shortly after a incus webui session is started; new containers or VMs created or modified without the knowledge of the legitimate user.
• File System: Unexpected changes to Incus container or VM configurations, new container images pulled, or modifications to container storage directories.

Upgrade Incus to version 6.23.0 or later, which patches the authentication token validation flaw (GitHub Security Advisory). As interim mitigations: restrict access to localhost ports using host-based firewall rules to prevent other local users from connecting to the incus webui port; avoid running incus webui on shared or multi-user systems until patched; and educate users not to click untrusted links that could direct their browser to the local Incus web server. Consider running incus webui only in isolated environments with restricted network access where possible.

The vulnerability was discovered and responsibly disclosed by the security research team at 7asecurity, with the fix developed by Incus maintainer stgraber (GitHub Security Advisory). Coverage appeared on The Hacker Wire shortly after disclosure. The openSUSE security announce mailing list also referenced the issue in the context of package updates (openSUSE Security). No significant broader community controversy or vendor dispute has been noted.