What’s Vulnerable › Products

lxc incus vulnerabilities

47 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 47 published in the last 12 months.

Check whether your lxc incus version is affected

Latest lxc incus vulnerabilities

• CVE-2026-115378 — Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pull (CVSS 5.8)
• CVE-2026-115377 — Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream (CVSS 9.9)
• CVE-2026-115376 — Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 Project Restriction Bypass via Custom Volume Copy (CVSS 7.7)
• CVE-2026-115375 — Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes (CVSS 9.9)
• CVE-2026-115374 — Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Unsigned Header Bypass in Presigned S3 Upload URLs (CVSS 7.1)
• CVE-2026-115373 — Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid} (CVSS 6.3)
• CVE-2026-115372 — Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options (CVSS 8.5)
• CVE-2026-115371 — LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys Endpoints (CVSS 7.1)
• CVE-2026-115370 — Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh (CVSS 4.3)
• CVE-2026-63343 — Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root (CVSS 9.9)
• CVE-2026-63125 — Incus vulnerable to root RCE via image backup.yaml symlink (CVSS 9.9)
• CVE-2026-62941 — Incus: Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge (CVSS 9.9)
• CVE-2026-62940 — Incus has a project restriction bypass via instance migration config override (CVSS 9.9)
• CVE-2026-62867 — Incus has an argument injection in storage volume block.create_options that leads to arbitrary command execution (CVSS 9.9)
• CVE-2026-62313 — Incus: Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated` (CVSS 4.3)
• CVE-2026-55622 — Incus has a project restriction bypass in instance copy across projects (CVSS 7.7)
• CVE-2026-55621 — Incus has a project restriction bypass for custom volume copy across projects (CVSS 7.7)
• CVE-2026-48769 — Incus has an arbitrary file write on its client due to trusted image hash (CVSS 9.9)
• CVE-2026-48756 — Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) (CVSS 2.1)
• CVE-2026-48755 — Incus has an argument injection in backup compression algorithm leading to AFW and ACE (CVSS 9.9)
• CVE-2026-48754 — Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} (CVSS 2.1)
• CVE-2026-48753 — Incus has an arbitrary file write via path traversal in S3 multipart upload (CVSS 9.9)
• CVE-2026-48752 — Incus has arbitrary file read+write on host via templates/ symlink in malicious image (CVSS 9.9)
• CVE-2026-48751 — Incus has a restricted project bypass leading to arbitrary command execution (CVSS 9.9)
• CVE-2026-48750 — Incus has an arbitrary file write on host via `exec-output` symlink in crafted image (CVSS 9.9)