CVE-2026-48769
Critical · CVSS 9.9- CVSS
- 9.9
- nvd
- EPSS
- —
- KEV
- No
- Class
- oss containerizable
- CWE-20
Description
Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches the issue.
Affected packages
| Go | github.com/lxc/incus | 0 → ∞ |
| Go | github.com/lxc/incus/v6 | 0 → ∞ |
| Go | github.com/lxc/incus/v7 | 0 → 7.2.0 |
| Go | github.com/lxc/incus/v7/cmd/incusd | 0 → 7.2.0 |
References
Status: profiled · ingested 2026-09-19T00:00:27.000Z