Tag
#Incus
Understanding and Defending Against Argument Injection in Incus
This educational analysis covers CVE-2026-62867, a critical vulnerability in Incus, a system container and virtual machine manager. The vulnerability, with a CVSS score of 9.9, allows project-scoped users to inject arbitrary arguments into commands executed as root, leading to potential system compromise. We will delve into the root cause, attack surface, exploitation mechanics, and provide defensive strategies.
Critical Vulnerability in Incus: Arbitrary File Write Leads to Root Command Execution
A critical vulnerability (CVE-2026-48769, CVSS 9.9) exists in Incus versions prior to 7.2.0, allowing an attacker to write arbitrary files and execute commands as root on the server. This is triggered by a malicious image server returning a crafted 'Incus-Image-Hash' header. Affected users must update to version 7.2.0 or later immediately.
Critical Path Traversal Vulnerability in Incus: CVE-2026-48753
A critical vulnerability (CVE-2026-48753) with a CVSS score of 9.9 affects Incus, a system container and virtual machine manager. The vulnerability allows for path traversal and creation of arbitrary files on the host, potentially leading to arbitrary command execution. The issue is fixed in version 7.1.0. Organizations using Incus prior to version 7.1.0 are advised to upgrade immediately.