CVE-2026-48750 lxc CVE debrief

Who should care

Users of Incus system container and virtual machine manager, particularly those with unpatched versions prior to 7.2.0, should be aware of this vulnerability and take necessary actions to mitigate it. This includes administrators of Incus deployments, security teams responsible for vulnerability management, and operators who may be impacted by the vulnerability. Additionally, platform teams and vulnerability management teams should review the affected scope and severity to determine the necessary course of action. Security teams should also review compensating controls for exposed systems while remediation is scheduled and verified. Asset inventory and change management teams may also need to be involved in the remediation process. Furthermore, incident response teams should be prepared to respond to potential exploitation of this vulnerability. IT teams responsible for system container and virtual machine management should prioritize patching to version 7.2.0 or later. Compliance teams may need to review and update vulnerability management policies and procedures. Communication teams should be aware of the potential impact on business operations and customer-facing services. Business stakeholders should be informed of the potential risks and mitigation strategies. External partners and vendors who rely on Incus may also need to be notified and take necessary actions. Overall, a coordinated effort across multiple teams is necessary to effectively mitigate this vulnerability. The vulnerability can be abused for arbitrary command execution, which can lead to a significant impact on the confidentiality, integrity, and availability of affected systems. The vulnerability requires careful consideration of the affected scope, severity, and potential impact on business operations. The necessary actions to mitigate the vulnerability include applying the patch in version 7.2.0, restricting access to the `/instances/$name/exec` endpoint, and monitoring for suspicious activity in the `exec-output` directory. The vulnerability highlights the importance of maintaining up-to-date software versions and implementing robust vulnerability management practices. The vulnerability is

Technical summary

The `record-output` parameter of the `/instances/$name/exec` endpoint in Incus stores command output in the `exec-output` directory of the instance. If `exec-output` is a symlink, files named `exec_UUID.stdout` and `exec_UUID.stderr` can be written to an arbitrary location, allowing for arbitrary content in the `.stdout` file. This behavior can be abused for arbitrary command execution. Version 7.2.0 contains a patch.

Defensive priority

Critical vulnerability in Incus, a system container and virtual machine manager, allowing for arbitrary command execution.

Recommended defensive actions

• Apply the patch in version 7.2.0
• Restrict access to the `/instances/$name/exec` endpoint
• Monitor for suspicious activity in the `exec-output` directory
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE-2026-48750 record indicates a critical vulnerability in Incus, a system container and virtual machine manager. The vulnerability exists in the `record-output` parameter of the `/instances/$name/exec` endpoint, which stores command output in the `exec-output` directory of the instance. If `exec-output` is a symlink, files can be written to an arbitrary location, allowing for arbitrary content in the `.stdout` file and potentially leading to arbitrary command execution. A patch is available in version 7.2.0.

Official resources