Incus does not verify combined fingerprint when downloading images from simplestreams servers
Summary
Incus does not verify combined fingerprint when downloading images from simplestreams servers
Original description
The description as published by the source.
Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from simplestreams image servers opens the door to image cache poisoning and under very narrow circumstances exposes other tenants to running attacker controlled images rather than the expected one. Version 6.23.0 patches the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-33542 incus Fixed in: 6.0.4-2+deb13u5
- Ubuntu UBUNTU-CVE-2026-33542 lxd
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov