Incus is a system container and virtual machine manager. Incus provides an API to retrieve VM screenshots. That API relies on the use of a temporary file for QEMU to write the screenshot to which is then picked up and sent to the user prior to deletion. As versions prior to 6.23.0 use predictable paths under /tmp for this, an attacker with local access to the system can abuse this mechanism by creating their own symlinks ahead of time. On the vast majority of Linux systems, this will result in a "Permission denied" error when requesting a screenshot. That's because the Linux kernel has a security feature designed to block such attacks, `protected_symlinks`. On the rare systems with this purposefully disabled, it's then possible to trick Incus intro truncating and altering the mode and permissions of arbitrary files on the filesystem, leading to a potential denial of service or possible local privilege escalation. Version 6.23.0 fixes the issue.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-094b7621cf advisory.

    Remove incus dependency from incus-agent.

    ----

    Update to [6.23](https://github.com/lxc/incus/releases/tag/v6.23.0)




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4481307278 advisory.

    Remove incus dependency from incus-agent.

    ----

    Update to [6.23](https://github.com/lxc/incus/releases/tag/v6.23.0)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Incus is a system container and virtual machine manager. Incus provides an API to retrieve VM screenshots.
    That API relies on the use of a temporary file for QEMU to write the screenshot to which is then picked up
    and sent to the user prior to deletion. As versions prior to 6.23.0 use predictable paths under /tmp for
    this, an attacker with local access to the system can abuse this mechanism by creating their own symlinks
    ahead of time. On the vast majority of Linux systems, this will result in a "Permission denied" error when
    requesting a screenshot. That's because the Linux kernel has a security feature designed to block such
    attacks, `protected_symlinks`. On the rare systems with this purposefully disabled, it's then possible to
    trick Incus intro truncating and altering the mode and permissions of arbitrary files on the filesystem,
    leading to a potential denial of service or possible local privilege escalation. Version 6.23.0 fixes the
    issue. (CVE-2026-33711)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Incus is a system container and virtual machine manager. Incus provides an API to retrieve VM screenshots.
    That API relies on the use of a temporary file for QEMU to write the screenshot to which is then picked up     and sent to the user prior to deletion. As versions prior to 6.23.0 use predictable paths under /tmp for     this, an attacker with local access to the system can abuse this mechanism by creating their own symlinks     ahead of time. On the vast majority of Linux systems, this will result in a Permission denied error when     requesting a screenshot. That's because the Linux kernel has a security feature designed to block such     attacks, `protected_symlinks`. On the rare systems with this purposefully disabled, it's then possible to     trick Incus intro truncating and altering the mode and permissions of arbitrary files on the filesystem,     leading to a potential denial of service or possible local privilege escalation. Version 6.23.0 fixes the     issue. (CVE-2026-33711)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
307511	Fedora 43 : incus (2026-094b7621cf)	Nessus	Fedora Local Security Checks	Local	high
307510	Fedora 42 : incus (2026-4481307278)	Nessus	Fedora Local Security Checks	Local	high
439355	SCA: security update for github.com/lxc/incus/v6 (GHSA-q9vp-3wcg-8p4x)	Tenable Cloud Security	SCA Checks	Local	medium
439355	SCA: security update for github.com/lxc/incus/v6 (GHSA-q9vp-3wcg-8p4x)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
303936	Linux Distros Unpatched Vulnerability : CVE-2026-33711	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-33711

medium

Tenable Plugins

high

high

medium

medium

medium