https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 04:02:49 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-07367 bdu:2026-07367 https://cve.radiocsirt.org/vuln/bdu:2026-07367 https://cve.radiocsirt.org/vuln/euvd-2026-277887 EUVD-2026-277887 https://cve.radiocsirt.org/vuln/euvd-2026-277887 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33945 <p>Incus is a system container and virtual machine manager. Incus instances have an option to provide credentials to systemd in the guest. For containers, this is handled through a shared directory. Prior to version 6.23.0, an attacker can set a configuration key named something like `systemd.credential.../../../../../../root/.bashrc` to cause Incus to write outside of the `credentials` directory associated with the container. This makes use of the fact that the Incus syntax for such credentials is `systemd.credential.XYZ` where `XYZ` can itself contain more periods. While it&#39;s not possible to read any data this way, it&#39;s possible to write to arbitrary files as root, enabling both privilege escalation and denial of service attacks. Version 6.23.0 fixes the issue.</p> <p>Incus is a system container and virtual machine manager. Incus instances have an option to provide credentials to systemd in the guest. For containers, this is handled through a shared directory. Prior to version 6.23.0, an attacker can set a configuration key named something like `systemd.credential.../../../../../../root/.bashrc` to cause Incus to write outside of the `credentials` directory associated with the container. This makes use of the fact that the Incus syntax for such credentials is `systemd.credential.XYZ` where `XYZ` can itself contain more periods. While it&#39;s not possible to read any data this way, it&#39;s possible to write to arbitrary files as root, enabling both privilege escalation and denial of service attacks. Version 6.23.0 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33945 https://cve.radiocsirt.org/vuln/ghsa-q4q8-7f2j-9h9f <p><strong>Affected:</strong> Go: github.com/lxc/incus/v6</p> <p>### Summary Incus instances have an option to provide credentials to systemd in the guest. For containers, this is handled through a shared directory. An attacker can use the name of a systemd credential to escape that directory and overwrite arbitrary files on the host system.</p> <p>This can in turn be used to perform local privilege escalation or cause a DoS.</p> <p>### Details An attacker can set a configuration key named something like `systemd.credential.../../../../../../root/.bashrc` to cause Incus to write outside of the `credentials` directory associated with the container. This makes use of the fact that the Incus syntax for such credentials is `systemd.credential.XYZ` where `XYZ` can itself contain more periods.</p> <p>While it&#39;s not possible to read any data this way, it&#39;s possible to write to arbitrary files as root, enabling both privilege escalation and denial of service attacks.</p> <p>### Credit This issue was discovered and reported by the team at [7asecurity](https://7asecurity.com/)</p> <p><strong>Affected:</strong> Go: github.com/lxc/incus/v6</p> <p>### Summary Incus instances have an option to provide credentials to systemd in the guest. For containers, this is handled through a shared directory. An attacker can use the name of a systemd credential to escape that directory and overwrite arbitrary files on the host system.</p> <p>This can in turn be used to perform local privilege escalation or cause a DoS.</p> <p>### Details An attacker can set a configuration key named something like `systemd.credential.../../../../../../root/.bashrc` to cause Incus to write outside of the `credentials` directory associated with the container. This makes use of the fact that the Incus syntax for such credentials is `systemd.credential.XYZ` where `XYZ` can itself contain more periods.</p> <p>While it&#39;s not possible to read any data this way, it&#39;s possible to write to arbitrary files as root, enabling both privilege escalation and denial of service attacks.</p> <p>### Credit This issue was discovered and reported by the team at [7asecurity](https://7asecurity.com/)</p> https://cve.radiocsirt.org/vuln/ghsa-q4q8-7f2j-9h9f https://cve.radiocsirt.org/vuln/opensuse-su-2026:10450-1 <p>incus-6.23-1.1 on GA media</p> <p>incus-6.23-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10450-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33945 <p><strong>Affected:</strong> Ubuntu:Pro:24.04:LTS: incus, Ubuntu:25.10: incus, Ubuntu:Pro:26.04:LTS: incus</p> <p>Incus is a system container and virtual machine manager. Incus instances have an option to provide credentials to systemd in the guest. For containers, this is handled through a shared directory. Prior to version 6.23.0, an attacker can set a configuration key named something like `systemd.credential.../../../../../../root/.bashrc` to cause Incus to write outside of the `credentials` directory associated with the container. This makes use of the fact that the Incus syntax for such credentials is `systemd.credential.XYZ` where `XYZ` can itself contain more periods. While it&#39;s not possible to read any data this way, it&#39;s possible to write to arbitrary files as root, enabling both privilege escalation and denial of service attacks. Version 6.23.0 fixes the issue.</p> <p><strong>Affected:</strong> Ubuntu:Pro:24.04:LTS: incus, Ubuntu:25.10: incus, Ubuntu:Pro:26.04:LTS: incus</p> <p>Incus is a system container and virtual machine manager. Incus instances have an option to provide credentials to systemd in the guest. For containers, this is handled through a shared directory. Prior to version 6.23.0, an attacker can set a configuration key named something like `systemd.credential.../../../../../../root/.bashrc` to cause Incus to write outside of the `credentials` directory associated with the container. This makes use of the fact that the Incus syntax for such credentials is `systemd.credential.XYZ` where `XYZ` can itself contain more periods. While it&#39;s not possible to read any data this way, it&#39;s possible to write to arbitrary files as root, enabling both privilege escalation and denial of service attacks. Version 6.23.0 fixes the issue.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33945