Critical Vulnerability in Incus: Arbitrary File Write Leads to Root Command Execution

Executive Summary

A critical vulnerability (CVE-2026-48769) with a CVSS score of 9.9 was discovered in Incus, a system container and virtual machine manager. This vulnerability exists in versions prior to 7.2.0 and allows for arbitrary file writes, potentially leading to root command execution on the server. The vulnerability is triggered when a malicious image server returns a crafted 'Incus-Image-Hash' header.

Technical Analysis

The vulnerability class of CVE-2026-48769 is an arbitrary file write vulnerability. The attack vector involves a malicious image server returning a crafted 'Incus-Image-Hash' header, which the Incus client fails to properly validate. This lack of validation allows an attacker to write arbitrary files on the system, potentially leading to arbitrary command execution as root. The root cause of this vulnerability is the missing input validation in the Incus client when handling the 'Incus-Image-Hash' header.

How It Gets Exploited

An attacker can exploit this vulnerability by operating a malicious image server. Here's a scenario: The attacker serves a malicious image with a crafted 'Incus-Image-Hash' header to the Incus client. The Incus client, failing to validate the header properly, writes the contents of the header to an arbitrary file on the system. If the attacker crafts the header to contain executable commands, they can achieve arbitrary command execution as root on the server. This can happen because the Incus client does not properly sanitize or restrict the contents of the 'Incus-Image-Hash' header.

Impact Assessment

Incus versions prior to 7.2.0 are affected by this vulnerability. An attacker exploiting this flaw can achieve arbitrary command execution as root, leading to a complete compromise of the server. The CVSS score of 9.9 indicates a critical severity level, reflecting the high impact on confidentiality, integrity, and availability. The vulnerability's scope is changed (S:C), indicating that the impact can extend beyond the initial point of exploitation.

Recommended Actions

To mitigate this vulnerability, users of Incus must update to version 7.2.0 or later. Additionally, administrators should ensure that only trusted image servers are used and that network access to the Incus client is restricted. Implementing a Web Application Firewall (WAF) rule to detect and block malicious 'Incus-Image-Hash' headers can provide additional protection.

Sources

- National Vulnerability Database (NVD) - GitHub Security Advisories