What is CVE-2026-33897?

CVE-2026-33897 is a critical-severity vulnerability in Linuxcontainers Incus, classified under Improper Neutralization of Special Elements Used in a Template Engine. CVSS score: 9.9/10. Published 2026-03-26.

How severe is CVE-2026-33897?

Critical severity. CVSS v3 base score is 9.9 out of 10.

Vulnerability in Linuxcontainers Incus

CVE-2026-33897

Incus is a system container and virtual machine manager. Prior to version 6.23.0, instance template files can be used to cause arbitrary read or writes as root on the host server. Incus allows for pongo2 templates within instances which ca…

EPSS: 0.005 (38.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Affected products

Linuxcontainers Incus
Lxc Incus — versions < 6.23.0

Weakness classification (CWE)

CWE-1336 — Improper Neutralization of Special Elements Used in a Template Engine

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2026-33897?: CVE-2026-33897 is a critical-severity vulnerability in Linuxcontainers Incus, classified under Improper Neutralization of Special Elements Used in a Template Engine. CVSS score: 9.9/10. Published 2026-03-26.
How severe is CVE-2026-33897?: Critical severity. CVSS v3 base score is 9.9 out of 10.