CVE-2026-63343 in Incus
Summary
by MITRE • 08/21/2026
Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a `metadata.yaml` symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadata API. The `exec-output` and `templates/` paths were patched in a prior release using `Lstat` rejection and `os.OpenRoot` confinement; `metadata.yaml` was not included in either patch and remains exploitable. Version 7.3.0 patches the issue.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
Incus serves as a comprehensive system container and virtual machine manager, facilitating the deployment and management of isolated environments on Linux systems. A critical security vulnerability exists within versions prior to 7.3.0 that allows an authenticated user with access to instance metadata APIs to compromise the host operating system. This flaw stems from improper handling of symbolic links within image metadata files, specifically targeting the `metadata.yaml` file which is used by Incus instances to retrieve configuration and identity information during initialization or runtime operations.
The technical root cause involves a path traversal vulnerability where an attacker can craft a malicious container image containing a symlink in its `metadata.yaml` file that points to arbitrary paths on the host filesystem, such as `/etc/shadow`, `/root/.ssh/authorized_keys`, or other sensitive configuration files. When Incus processes this metadata through the instance metadata API without adequate validation of symbolic link targets, it effectively dereferences the symlink and exposes the contents of the target file to the authenticated user within the container context. This behavior violates the principle of least privilege and breaks the isolation boundary between the guest environment and the host system.
The operational impact is severe because Incus typically runs with elevated privileges or root capabilities on the host to manage namespaces, cgroups, and device access. Consequently, an attacker who can read arbitrary files gains immediate insight into sensitive credentials, private keys, and configuration details that could facilitate further lateral movement or privilege escalation attacks within the broader infrastructure. If write permissions are inadvertently exposed through similar mechanisms in related paths, the attacker could overwrite critical system files, potentially leading to complete host compromise, denial of service, or persistence via modified startup scripts or SSH configurations.
This specific vulnerability was not addressed in prior security patches that mitigated similar risks for other metadata endpoints such as `exec-output` and `templates/`. Those earlier fixes utilized techniques like Lstat rejection to prevent symlink traversal and os.OpenRoot confinement to restrict file access to the image root directory. However, the developers overlooked applying these same rigorous checks to the `metadata.yaml` processing logic, leaving a gap in the defense-in-depth strategy that allowed this specific attack vector to remain open despite previous remediation efforts for related components.
To mitigate this risk, organizations must immediately upgrade Incus to version 7.3.0 or later, which includes the necessary code changes to validate symlink targets and enforce strict path confinement within the metadata API handlers. Until upgrading is possible, administrators should restrict access to the instance metadata API using network-level controls such as firewalls or reverse proxies that limit connectivity to trusted internal networks only. Additionally, enforcing strong authentication mechanisms for Incus users reduces the attack surface by ensuring that only verified identities can interact with potentially vulnerable endpoints.
From a classification perspective, this vulnerability aligns with CWE-59 Improper Link Resolution Before File Access, as it involves the exploitation of symbolic links to bypass intended file access restrictions. It also maps to MITRE ATT&CK technique T1083 File and Directory Discovery, where an attacker enumerates sensitive files on the host system to gather intelligence for subsequent attacks. The scenario further relates to CWE-269 Improper Privilege Management if the metadata API is accessible by users who should not have such privileges, highlighting the importance of strict access control policies in container orchestration platforms.