Incus is a system container and virtual machine manager. Incus provides an API to retrieve VM screenshots. That API relies on the use of a temporary file for QEMU to write the screenshot to which is then picked up and sent to the user prior to deletion. As versions prior to 6.23.0 use predictable paths under /tmp for this, an attacker with local access to the system can abuse this mechanism by creating their own symlinks ahead of time. On the vast majority of Linux systems, this will result in a "Permission denied" error when requesting a screenshot. That's because the Linux kernel has a security feature designed to block such attacks, `protected_symlinks`. On the rare systems with this purposefully disabled, it's then possible to trick Incus intro truncating and altering the mode and permissions of arbitrary files on the filesystem, leading to a potential denial of service or possible local privilege escalation. Version 6.23.0 fixes the issue.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-094b7621cf advisory.

    Remove incus dependency from incus-agent.

    ----

    Update to [6.23](https://github.com/lxc/incus/releases/tag/v6.23.0)




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4481307278 advisory.

    Remove incus dependency from incus-agent.

    ----

    Update to [6.23](https://github.com/lxc/incus/releases/tag/v6.23.0)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Incus is a system container and virtual machine manager. Incus provides an API to retrieve VM screenshots.
    That API relies on the use of a temporary file for QEMU to write the screenshot to which is then picked up     and sent to the user prior to deletion. As versions prior to 6.23.0 use predictable paths under /tmp for     this, an attacker with local access to the system can abuse this mechanism by creating their own symlinks     ahead of time. On the vast majority of Linux systems, this will result in a Permission denied error when     requesting a screenshot. That's because the Linux kernel has a security feature designed to block such     attacks, `protected_symlinks`. On the rare systems with this purposefully disabled, it's then possible to     trick Incus intro truncating and altering the mode and permissions of arbitrary files on the filesystem,     leading to a potential denial of service or possible local privilege escalation. Version 6.23.0 fixes the     issue. (CVE-2026-33711)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
307511	Fedora 43 : incus (2026-094b7621cf)	Nessus	Fedora Local Security Checks	high
307510	Fedora 42 : incus (2026-4481307278)	Nessus	Fedora Local Security Checks	high
303936	Linux Distros Unpatched Vulnerability : CVE-2026-33711	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-33711

medium

Tenable Plugins

high

high

medium