Vulnerability in Lxc Incus-os
CVE-2026-32606
IncusOS is an immutable OS image dedicated to running Incus. Prior to 202603142010, the default configuration of systemd-cryptenroll as used by IncusOS through mkosi allows for an attacker with physical access to the machine to access the…
EPSS: 0.000 (0.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Lxc Incus-os — versions < 202603142010
Weakness classification (CWE)
Public proof-of-concept exploits
References
- https://github.com/lxc/incus-os/security/advisories/GHSA-wj2j-qwcf-cfcc (x_refsource_CONFIRM)
- https://github.com/lxc/incus-os/pull/954 (x_refsource_MISC)
- https://github.com/lxc/incus-os/commit/e3b35f230d23443d27752eac27ebb2b22c957b75 (x_refsource_MISC)
- https://discuss.linuxcontainers.org/t/potential-luks-encryption-bypass-through-filesystem-confusion/26348 (x_refsource_MISC)
- https://oddlama.org/blog/bypassing-disk-encryption-with-tpm2-unlock (x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-32606?
- CVE-2026-32606 is a high-severity vulnerability in Lxc Incus-os, classified under Insufficiently Protected Credentials. CVSS score: 7.6/10. Published 2026-03-18.
- How severe is CVE-2026-32606?
- High severity. CVSS v3 base score is 7.6 out of 10.
- Is CVE-2026-32606 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.