Incus: 18 Vulnerabilities Disclosed, Nine Critical, Allowing Root Access
Key findings • 18 vulnerabilities disclosed for Incus, including nine Critical-severity flaws (CVSSv3 9.9). • Multiple CVEs allow arbitrary file read/write and command execution via crafted i…
Key findings
- 18 vulnerabilities disclosed for Incus, including nine Critical-severity flaws (CVSSv3 9.9).
- Multiple CVEs allow arbitrary file read/write and command execution via crafted images and backups.
- Privilege escalation and bypass of security restrictions are key themes across several vulnerabilities.
- Affected versions prior to 7.3.0, 7.2.0, and 7.1.0 are patched in these releases.
- Vulnerabilities stem from improper handling of user data and weak access controls.
On August 21, 2026, a significant batch of 18 vulnerabilities was disclosed for Incus, the system container and virtual machine manager developed by Lxc. These vulnerabilities, all disclosed on the same day, range in severity from Low to Critical, with a notable cluster of nine Critical-severity flaws (CVSSv3 9.9) impacting versions prior to 7.3.0, 7.2.0, and 7.1.0. The disclosures highlight a range of security weaknesses, including arbitrary file read/write, command execution, and privilege escalation.
Several vulnerabilities stem from improper handling of user-supplied data within image and backup operations. CVE-2026-63343 and CVE-2026-63125, for instance, allow authenticated Incus users to read or overwrite arbitrary host files as root by crafting specific metadata.yaml or backup.yaml files, potentially leading to arbitrary code execution. Similarly, CVE-2026-48755 exploits improper validation of backup compression algorithms to achieve arbitrary file writes and command execution. CVE-2026-48753 demonstrates a path traversal vulnerability in the S3 protocol upload endpoint, enabling arbitrary file creation on the host. CVE-2026-48752 and CVE-2026-48749 also detail how crafted images or backups can lead to arbitrary file manipulation and command execution.
Privilege escalation and bypass of security restrictions are also prominent themes. CVE-2026-62941 and CVE-2026-62940 reveal that project restrictions can be bypassed during instance copying and migration, respectively, allowing dangerous configuration keys to be applied without proper enforcement, potentially granting root access. CVE-2026-62313 describes a bypass of the restricted.containers.privilege=isolated setting, enabling users to create non-isolated containers even when forbidden. CVE-2026-48751 indicates that instance snapshots ignore the restricted.containers.lowlevel=block setting, enabling arbitrary command execution via low-level hooks.
Other critical vulnerabilities include CVE-2026-48769, which involves an arbitrary file write in the Incus client due to a crafted Incus-Image-Hash header from a malicious image server, leading to command execution as root. CVE-2026-55622 and CVE-2026-55621 highlight missing authorization checks for instance and custom volume copying, respectively, allowing unauthorized users to copy resources from projects they do not have access to. CVE-2026-62867 involves argument injection in storage volume configuration, leading to command line argument injection during filesystem creation. CVE-2026-48750 details how the record-output parameter can be abused if exec-output is a symlink, potentially leading to file manipulation.
The batch also includes two medium-severity vulnerabilities: CVE-2026-47753, a nil-pointer dereference in CreateInstanceFromBackup triggered by a crafted backup, and CVE-2026-62313, which allows bypassing privilege isolation settings. Two low-severity vulnerabilities, CVE-2026-48756 and CVE-2026-48754, involve unguarded pointer dereferences in volume backup processing.
The affected versions span across multiple release lines, with fixes distributed in versions 7.3.0, 7.2.0, and 7.1.0. Users of Incus are strongly advised to update to the patched versions to mitigate these critical security risks. The coordinated disclosure of these vulnerabilities underscores the importance of timely patching and security diligence for users of the Incus platform.
Key findings from this disclosure include:
- A large batch of 18 vulnerabilities affecting Incus, with a significant number rated Critical (CVSSv3 9.9).
- Multiple vulnerabilities allow for arbitrary file read/write and command execution as root through crafted images, backups, or API interactions.
- Several flaws enable privilege escalation and bypass of security restrictions, including instance and volume copying controls.
- Patches are available in Incus versions 7.3.0, 7.2.0, and 7.1.0, depending on the specific vulnerability.
- The disclosures highlight systemic issues in handling user-supplied data and enforcing project-level restrictions.
- Two medium-severity and two low-severity vulnerabilities were also part of this coordinated disclosure.