CVE-2026-48751
Critical · CVSS 9.9- CVSS
- 9.9
- nvd
- EPSS
- —
- KEV
- No
- Class
- oss containerizable
- CWE-862
Description
Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as `raw.lxc` and `raw.qemu`. Version 7.2.0 patches the issue.
Affected packages
| Go | github.com/lxc/incus | 0 → ∞ |
| Go | github.com/lxc/incus/v6 | 0 → ∞ |
| Go | github.com/lxc/incus/v7 | 0 → 7.2.0 |
| Go | github.com/lxc/incus/v7/cmd/incusd | 0 → 7.2.0 |
References
Status: profiled · ingested 2026-09-19T00:00:27.000Z