CVE-2026-33898

@@ -214,6 +214,7 @@ func (t remoteProxyTransport) RoundTrip(r *http.Request) (*http.Response, error)
 type remoteProxyHandler struct {
 	s         incus.InstanceServer
 	transport http.RoundTripper
+	url       string
 
 	mu           *sync.RWMutex
 	connections  *uint64
@@ -238,6 +239,12 @@ func (h remoteProxyHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	*h.connections++
 	h.mu.Unlock()
 
+	// Don't allow cross-origin requests.
+	origin := r.Header.Get("Origin")
+	if origin != "" && origin != h.url {
+		return
+	}
+
 	// Basic auth.
 	if h.token != "" {
 		// Parse query URL.
@@ -248,6 +255,8 @@ func (h remoteProxyHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 		token := values.Get("auth_token")
 		if token != "" {
+			// If a token was passed through the URL, persist it as a cookie.
+
 			tokenCookie := http.Cookie{
 				Name:     "auth_token",
 				Value:    token,
@@ -259,11 +268,21 @@ func (h remoteProxyHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 			http.SetCookie(w, &tokenCookie)
 		} else {
+			// If not, attempt to pull it from the cookie.
 			cookie, err := r.Cookie("auth_token")
-			if err != nil || cookie.Value != h.token {
+			if err != nil {
+				// Fail authentication if no cookie can be found.
 				w.WriteHeader(http.StatusUnauthorized)
 				return
 			}
+
+			token = cookie.Value
+		}
+
+		// Check the user token against the expected value.
+		if token != h.token {
+			w.WriteHeader(http.StatusUnauthorized)
+			return
 		}
 	}
 

@@ -98,6 +98,7 @@ func (c *cmdWebui) Run(cmd *cobra.Command, args []string) error {
 		transactions: &transactions,
 
 		token: token,
+		url:   "http://" + server.Addr().String(),
 	}
 
 	// Print address.