Incus is a system container and virtual machine manager. Prior to version 6.23.0, the web server spawned by `incus webui` incorrectly validates the authentication token such that an invalid value will be accepted. `incus webui` runs a local web server on a random localhost port. For authentication, it provides the user with a URL containing an authentication token. When accessed with that token, Incus creates a cookie persisting that token without needing to include it in subsequent HTTP requests. While the Incus client correctly validates the value of the cookie, it does not correctly validate the token when passed int the URL. This allows for an attacker able to locate and talk to the temporary web server on localhost to have as much access to Incus as the user who ran `incus webui`. This can lead to privilege escalation by another local user or an access to the user's Incus instances and possibly system resources by a remote attack able to trick the local user into interacting with the Incus UI web server. Version 6.23.0 patches the issue.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4481307278 advisory.

    Remove incus dependency from incus-agent.

    ----

    Update to [6.23](https://github.com/lxc/incus/releases/tag/v6.23.0)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Incus is a system container and virtual machine manager. Prior to version 6.23.0, the web server spawned
    by `incus webui` incorrectly validates the authentication token such that an invalid value will be
    accepted. `incus webui` runs a local web server on a random localhost port. For authentication, it
    provides the user with a URL containing an authentication token. When accessed with that token, Incus
    creates a cookie persisting that token without needing to include it in subsequent HTTP requests. While
    the Incus client correctly validates the value of the cookie, it does not correctly validate the token
    when passed int the URL. This allows for an attacker able to locate and talk to the temporary web server
    on localhost to have as much access to Incus as the user who ran `incus webui`. This can lead to privilege
    escalation by another local user or an access to the user's Incus instances and possibly system resources
    by a remote attack able to trick the local user into interacting with the Incus UI web server. Version
    6.23.0 patches the issue. (CVE-2026-33898)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Incus is a system container and virtual machine manager. Prior to version 6.23.0, the web server spawned     by `incus webui` incorrectly validates the authentication token such that an invalid value will be     accepted. `incus webui` runs a local web server on a random localhost port. For authentication, it     provides the user with a URL containing an authentication token. When accessed with that token, Incus     creates a cookie persisting that token without needing to include it in subsequent HTTP requests. While     the Incus client correctly validates the value of the cookie, it does not correctly validate the token     when passed int the URL. This allows for an attacker able to locate and talk to the temporary web server     on localhost to have as much access to Incus as the user who ran `incus webui`. This can lead to privilege     escalation by another local user or an access to the user's Incus instances and possibly system resources     by a remote attack able to trick the local user into interacting with the Incus UI web server. Version     6.23.0 patches the issue. (CVE-2026-33898)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
307510	Fedora 42 : incus (2026-4481307278)	Nessus	Fedora Local Security Checks	high
439367	SCA: security update for github.com/lxc/incus/v6/cmd/incus (GHSA-453r-g2pg-cxxq)	Tenable Cloud Security	SCA Checks	high
439367	SCA: security update for github.com/lxc/incus/v6/cmd/incus (GHSA-453r-g2pg-cxxq)	Tenable Self-Hosted Container Security	SCA Checks	high
303937	Linux Distros Unpatched Vulnerability : CVE-2026-33898	Nessus	Misc.	high

Detections

Analytics

CVE-2026-33898

high

Tenable Plugins

high

high

high

high