CVE-2026-48769 in Incus
Summary
by MITRE • 08/21/2026
Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches the issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified within Incus, specifically prior to version 7.2.0, represents a critical security flaw rooted in improper validation of external input during image handling operations. Incus functions as both a system container and virtual machine manager, relying heavily on remote image servers to fetch operating system templates and configurations for instantiation. The core technical failure lies in the client-side processing of metadata headers returned by these servers. Specifically, when an attacker controls or compromises an image server, they can inject a maliciously crafted Incus-Image-Hash header into the HTTP response stream sent back to the Incus client. This header is intended to provide integrity verification for downloaded images but lacks sufficient sanitization before being used in file system operations.
The exploitation mechanism involves manipulating this hash header to dictate arbitrary paths on the local host where data will be written. By carefully constructing the value of the Incus-Image-Hash header, an attacker can bypass standard directory restrictions and write files to sensitive locations within the server's operating system. This constitutes a classic path traversal vulnerability combined with insecure direct object references in file handling logic. Because the Incus client typically operates with elevated privileges or interacts directly with privileged daemons on the host machine, the ability to write arbitrary files effectively grants the attacker control over critical system components.
The operational impact of this flaw is severe, leading directly to remote code execution as root. Once an arbitrary file can be written to a location such as /etc/cron.d, /usr/local/bin, or other executable paths monitored by systemd services, the attacker can plant malicious scripts or binaries that execute with full administrative privileges upon invocation. This allows for complete compromise of the underlying host infrastructure, enabling data exfiltration, lateral movement within the network, and persistent access without detection through standard user-level auditing tools. The severity is amplified because it requires no authentication if the image server URL is trusted by default in certain configurations or if social engineering tricks users into pointing to a malicious registry.
From an industry standards perspective, this vulnerability aligns with CWE-436, which describes interpretation ambiguity leading to security issues, and more specifically CWE-22 for improper limitation of a pathname to a restricted directory. In the context of the MITRE ATT&CK framework, this exploit maps to T1059 Command and Scripting Interpreter via file creation or modification techniques, allowing adversaries to establish persistence or execute commands remotely. The attack vector is classified as Network-based with low complexity but high impact due to the privilege level achieved upon successful exploitation.
Mitigation strategies primarily involve upgrading the Incus installation to version 7.2.0 or later, where this specific parsing logic has been corrected to strictly validate and sanitize header inputs before any file system interaction occurs. In environments where immediate patching is not feasible, administrators should restrict access to image servers by implementing strict network segmentation and firewall rules that only allow connections from trusted, verified registries. Additionally enabling mutual TLS for communication with image repositories can prevent man-in-the-middle attacks or the use of compromised third-party servers. Regular auditing of cron jobs and startup scripts on hosts running Incus clients is also recommended to detect any unauthorized modifications resulting from potential prior exploitation attempts.