# Incus does not verify combined fingerprint when downloading images from simplestreams servers

Incus validated per-file SHA256 but not the combined image fingerprint from simplestreams indexes, letting an attacker serve a poisoned image under a legitimate fingerprint and poison the shared image cache.

- Payout: Research
- Severity: high
- Program: Incus
- Found by: wl2018
- Disclosed: 2026-03-27
- CVE: CVE-2026-33542
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-p8mm-23gg-jc9r
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-p8mm-23gg-jc9r
- Tags: area:cloud domain:cloud domain:infra impact:integrity impact:rce kind:research platform:ghsa sev:high tech:linux technique:source-review vuln:crypto vuln:misconfiguration

**Target:** simplestreams image download client (incus client / image cache)
**Root cause:** When downloading from a simplestreams server, Incus verifies the SHA256 of each individual file but never checks that the SHA256 of the concatenated files matches the fingerprint advertised in the simplestreams index, so a server can pair a legitimate fingerprint with different file contents.
**Steps:**
1. Download `https://images.linuxcontainers.org/streams/v1/{index,images}.json` and the image files `.../DISTRO/RELEASE/ARCH/default/NEWEST/{incus.tar.xz,rootfs.squashfs`.
2. Serve them over HTTPS from an attacker-controlled server with a CA-trusted cert.
3. Modify `rootfs.squashfs` via `unsquashfs`/`mksquashfs`, add `echo 'PoC: hacked!'` to `/root/.bashrc`.
4. Update the per-file `sha256` and `size` fields in `images.json` (leave the combined/fingerprint fields pointing at the legitimate image).
5. `incus remote add poc https://TESTSERVER:4443 --protocol simplestreams`
6. `incus image copy poc:debian/trixie local:` — copies successfully under the legitimate fingerprint `945758c6...` despite differing content.
7. `incus launch images:debian/trixie` then `incus exec star-mollusk bash` prints `PoC: hacked!`.
**How found:** Code review of the simplestreams download path: noticed per-file SHA256 validation existed but the concatenated-hash-vs-index-fingerprint check was absent, then built a malicious simplestreams server to confirm the client accepted mismatched content under a legitimate fingerprint.
**Exploitation:** Attacker with access to an Incus server lacking `restricted.image.servers` or equivalent firewall/proxy policy registers an attacker-controlled simplestreams remote serving a modified image under a well-known legitimate fingerprint. Copying it into the local/global image cache poisons the cache so other tenants deploying that image later receive the compromised one. Requires predicting which image other users will pull before the legitimate copy is cached, and timing against new image publications.
**Escalation:** Cache poisoning pivots a single tenant's image pull into cross-tenant code execution when other users launch the same image alias.
**Insight:** When a client validates per-artifact hashes, check whether it also validates the aggregate/combined hash that the index advertises — the gap between per-file and combined integrity checks is where cache-poisoning lives. Test by serving modified files with updated per-file hashes but stale combined fingerprint fields.

## Proof of concept (copied exactly from the original report)

**Fingerprint mismatch proof via image export hashes**

```
$ incus image export images:debian/trixie
Image exported successfully!                  
$ cat incus.tar.xz rootfs.squashfs | sha256sum
945758c6900211055b3b0b6d2ab9617a9f9dbeb70e4c3b9710dc47aa01345369  -
$ rm incus.tar.xz rootfs.squashfs
$ incus image export poc:debian/trixie
Image exported successfully!                   
$ cat incus.tar.xz rootfs.squashfs | sha256sum
d3ec6f76cc1e4e49479e52c69b3d71430748f7c86d1214f44893e131392ad002  -
```