CVE-2026-48769 lxc CVE debrief

Who should care

Users of Incus, especially those with untrusted image sources, should be aware of this critical vulnerability. Operators of Incus-based systems, platform administrators, and security teams should prioritize patching and monitoring. Vulnerability management and security teams should review system configurations, assess potential exposure, and implement compensating controls if necessary.

Technical summary

The Incus client is vulnerable to an arbitrary file write issue when a malicious image server returns a crafted 'Incus-Image-Hash' header, potentially leading to arbitrary command execution as root on the server. This issue is patched in version 7.2.0. The vulnerability affects Incus versions prior to 7.2.0 and can be exploited through a malicious image server. Defenders should focus on upgrading to the patched version and monitoring for suspicious activity.

Defensive priority

Critical vulnerability in Incus, a system container and virtual machine manager, allowing for arbitrary file writes and command execution as root.

Recommended defensive actions

• Upgrade to Incus version 7.2.0 or later
• Restrict access to the Incus client
• Monitor for suspicious activity
• Review system configurations and assess potential exposure
• Implement compensating controls if necessary
• Track exceptions and retest remediated assets
• Verify Incus client configurations and review system logs for potential exploitation attempts

Evidence notes

The Incus client is vulnerable to an arbitrary file write issue when a malicious image server returns a crafted 'Incus-Image-Hash' header, potentially leading to arbitrary command execution as root on the server. This issue is patched in version 7.2.0. Evidence is limited to public sources and may not reflect the full scope of affected systems or potential impact. Defenders should verify Incus client configurations, monitor for suspicious activity, and review system logs for potential exploitation attempts.

Official resources