Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-48751: Incus lets restricted projects run any command
CVE-2026-48751 · published 13 days ago
Summary
Incus snapshots ignore a setting that should block low-level container hooks, so a user can craft a snapshot that runs their own code on the host server. When the snapshot is moved into a restricted project and restored, it can execute commands with full system privileges. Apply the latest Incus update or disable snapshot transfers into restricted projects until a fix is released.
What to do
- Update github.com lxc to version 7.2.0.
- Update lxc github.com/lxc/incus/v7 to version 7.2.0.
- Update debian incus to version 6.0.4-2+deb13u8.
- Update debian incus to version 7.0.0-5.
- Update debian lxd to version 5.0.2+git20231211.1364ae4-9+deb13u7.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:13 | debian | incus |
< 6.0.4-2+deb13u8 Fix: upgrade to 6.0.4-2+deb13u8
|
| Debian:14 | debian | incus |
< 7.0.0-5 Fix: upgrade to 7.0.0-5
|
| Debian:12 | debian | lxd | All versions |
| Debian:13 | debian | lxd |
< 5.0.2+git20231211.1364ae4-9+deb13u7 Fix: upgrade to 5.0.2+git20231211.1364ae4-9+deb13u7
|
| go | github.com | lxc |
< 7.2.0 Fix: upgrade to 7.2.0
|
| Go | lxc | github.com/lxc/incus | All versions |
| Go | lxc | github.com/lxc/incus/v6 | All versions |
| Go | lxc | github.com/lxc/incus/v7 |
< 7.2.0 Fix: upgrade to 7.2.0
|
| – | lxc | incus | < 7.2.0 |
| Ubuntu:Pro:16.04:LTS | canonical | lxd | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | lxd | All versions |
| Ubuntu:20.04:LTS | canonical | lxd | All versions |
| Ubuntu:Pro:24.04:LTS | canonical | incus | All versions |
| Ubuntu:25.10 | canonical | incus | All versions |
| Ubuntu:Pro:26.04:LTS | canonical | incus | All versions |
Original advisory text
Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command executi...
Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as `raw.lxc` and `raw.qemu`. Version 7.2.0 patches the issue.
References
- https://security-tracker.debian.org/tracker/CVE-2026-48751 Vendor Advisory
- https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv Third Party Advisory
- https://github.com/advisories/GHSA-48q5-w887-33wv
- https://github.com/canonical/lxd/pull/18604 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-48751 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-48751 Third Party Advisory
Severity
9.9
Critical
CVSS 3.1: 9.9 (GHSA)
CVSS 3.1: 9.9 (OSV)
Exploitation
EPSS <1%
Type
CWE-862Missing Authorization
Timeline
Published21 Aug 2026
Updated3 Sep 2026
First seen26 Jun 2026
Sources
DEBIAN-CVE-2026-48751 · OSV
UBUNTU-CVE-2026-48751 · OSV
GHSA-48q5-w887-33wv · GHSA
GO-2026-5799 · OSV
CVE-2026-48751 · NVD
CVE-2026-48751 · MITRE
Monitor software like this
Free during beta