CVE-2026-41685 in incus
Summary
by MITRE • 05/07/2026
Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads of large amount of data by authenticated users can run the Incus server out of disk space, potentially taking down the host system. The impact here is limited for anyone using storage.images_volume and storage.backups_volume as those users will have large uploads be stored on those volumes rather than directly on the host filesystem. This is the default behavior on IncusOS. This issue has been patched in version 7.0.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 06/13/2026
The vulnerability in Incus prior to version 7.0.0 represents a critical resource exhaustion flaw that could lead to system-wide disruption through disk space depletion. This issue specifically affects authenticated users who can upload substantial amounts of data to the Incus server, creating a scenario where the host system's storage capacity becomes exhausted. The vulnerability stems from inadequate validation and enforcement of upload limits, allowing malicious or careless users to consume available disk space without proper bounds. Such a flaw falls under the category of denial of service through resource exhaustion, which is classified as CWE-400 in the Common Weakness Enumeration framework. The attack surface is particularly concerning because it can potentially take down the entire host system rather than just individual containers or virtual machines, demonstrating the severity of improper resource management in container orchestration platforms.
The technical implementation of this vulnerability occurs when authenticated users perform large data uploads directly to the host filesystem rather than utilizing the designated storage volumes. In default configurations, IncusOS automatically employs storage.images_volume and storage.backups_volume for managing large uploads, which provides a protective mechanism against direct host filesystem consumption. However, when users or administrators configure the system differently, or when these protective volume configurations are bypassed, the risk becomes significantly elevated. The server's lack of proper disk space monitoring and enforcement mechanisms means that upload operations can continue unchecked until the host filesystem becomes completely full, potentially causing cascading failures across the entire system infrastructure.
The operational impact of this vulnerability extends beyond simple service disruption to encompass potential system instability and data loss scenarios. When the host system runs out of disk space, critical system processes may fail, logging mechanisms may stop functioning, and the overall stability of the containerized environment becomes compromised. This issue particularly affects environments where storage resources are not properly monitored or where administrators have not implemented appropriate quotas and limits. The vulnerability demonstrates how seemingly benign user operations can lead to catastrophic system failures, highlighting the importance of proper resource management and access controls in container management systems. Organizations using Incus in production environments without proper safeguards could face significant downtime and recovery challenges when this vulnerability is exploited.
Mitigation strategies for this vulnerability should focus on implementing comprehensive disk space monitoring, enforcing upload size limits, and ensuring proper storage volume configuration. Administrators should verify that storage.images_volume and storage.backups_volume are properly configured and utilized for large data transfers rather than direct host filesystem access. The patch released in version 7.0.0 addresses this issue through enhanced resource management controls and improved validation mechanisms that prevent unauthorized consumption of host storage resources. Organizations should also implement monitoring solutions that track disk space usage and alert administrators when thresholds are approached, following best practices outlined in the MITRE ATT&CK framework for resource exhaustion attacks. Regular security assessments and proper configuration management are essential to prevent exploitation of this type of vulnerability in containerized environments.