Critical severity9.9NVD Advisory· Published Aug 21, 2026· Updated Aug 21, 2026
CVE-2026-48769
CVE-2026-48769
Description
Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches the issue.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/lxc/incus/v7/cmd/incusdGo | < 7.2.0 | 7.2.0 |
Affected products
2- osv-coordsRange: < 0.0.20260723T184607-160000.1.1
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.