A critical authentication bypass vulnerability in the Incus web interface allows unauthorized access to container and virtual machine management, potentially leading to full system compromise.

The web server component of the Incus web interface suffers from improper authentication (CWE-287), where the system fails to correctly validate tokens provided via URL. This allows an attacker to bypass authentication controls and gain the same access level as the local user running the interface.

The vulnerability carries a CVSS score of 8.8, reflecting its high potential for severe impact. Successful exploitation grants an attacker unauthorized control over containerized environments and virtual machines, which may result in data exfiltration, system manipulation, or unauthorized resource consumption. Given that the web interface is used for management, the risk of total loss of confidentiality, integrity, and availability within the affected environment is significant.

Immediate Action: Update the Incus software to version 6.23.0 or later to apply the necessary authentication token validation patches.

Proactive Monitoring: Review system logs for unauthorized access attempts to the localhost ports used by the Incus web interface and monitor for unusual container or virtual machine lifecycle events.

Compensating Controls: Restrict access to the Incus web interface by binding the service to specific secure interfaces rather than all localhost addresses, and implement network segmentation to prevent remote access to the local web server port.

Public Exploit Available: Unknown

Organizations utilizing Incus for container or virtual machine management should prioritize this update immediately. While the vulnerability requires the web interface to be active and reachable, the potential for privilege escalation and unauthorized resource control necessitates a swift patching cycle to close the authentication gap introduced in earlier versions.