LXC - CraftedSignal Threat Feed

Incus Container Escape via Arbitrary File Read/Write (CVE-2026-48749)

hello@craftedsignal.io — Fri, 03 Jul 2026 10:40:37 +0000

A critical vulnerability, tracked as CVE-2026-48749, has been identified in Incus, a container and VM management system developed by LXC. This flaw enables a malicious actor to achieve arbitrary file read and write capabilities on the host system with root privileges, potentially escalating to full command execution. The vulnerability arises from Incus's handling of specially crafted container images, specifically when a duplicate top-level rootfs symlink is present. While Incus initially validates metadata.yaml and a normal rootfs/ entry, it subsequently processes a symlink like rootfs -> /, allowing a container's root filesystem to be mapped directly to the host's root. This bypasses container isolation, granting the attacker unauthorized access to the host's underlying filesystem and sensitive files such as /etc/shadow, affecting Incus versions prior to 7.2.0.

Attack Chain

An attacker crafts a malicious Incus image package (.tar file) that initially contains a valid metadata.yaml and an empty rootfs/ directory.
The attacker then manipulates the .tar archive by removing the legitimate rootfs/ directory.
A symbolic link named rootfs pointing to / (the host's root directory) is injected into the archive at the top level.
The malicious image (afrw-rootfs-symlink.tar) is imported into a vulnerable Incus instance using incus image import.
A new container is initialized from this malicious image using incus init afrw-rootfs-symlink afrw-rootfs-symlink.
The attacker uses incus file pull commands, targeting paths like /etc/shadow from within the created container, to read arbitrary files from the host filesystem.
The attacker uses incus file push commands to write or create arbitrary files on the host filesystem.
Successful arbitrary file read/write with root privileges can lead to host compromise, including privilege escalation or arbitrary command execution.

Impact

Successful exploitation of CVE-2026-48749 leads to arbitrary file read and write on the host system with root privileges. This means an attacker can access any file on the host, including sensitive system configuration files (e.g., /etc/shadow for password hashes) or application data. Furthermore, the ability to write arbitrary files allows for planting malicious executables, modifying critical system configurations, or establishing persistence mechanisms. Ultimately, this can lead to full host compromise, enabling arbitrary command execution, data exfiltration, system defacement, or further lateral movement within the compromised environment. The vulnerability impacts organizations utilizing Incus for containerization and could lead to significant data breaches or operational disruption.

Recommendation

Prioritize patching all Incus instances to version 7.2.0 or later immediately to remediate CVE-2026-48749.
Review Incus image origins and implement strict controls to prevent the import of untrusted or malicious container images.
Monitor Incus server logs for unusual image import attempts or unexpected file operations performed via incus file commands originating from newly provisioned containers.

Incus Restricted Project Bypass Leading to Arbitrary Command Execution (CVE-2026-48751)

hello@craftedsignal.io — Fri, 03 Jul 2026 10:38:26 +0000

A critical vulnerability (CVE-2026-48751) has been identified in Incus, affecting all versions prior to 7.2.0. This flaw allows a malicious actor to achieve arbitrary command execution with root privileges on the Incus server. The vulnerability stems from instance snapshots ignoring the restricted.containers.lowlevel=block setting. Attackers can craft a malicious Incus instance locally, integrate a snapshot configured to abuse low-level hooks like raw.lxc or raw.qemu, and then transfer this instance to a restricted project. When the malicious snapshot is restored within the restricted environment, the embedded commands are executed on the host, bypassing intended security controls. This allows for complete compromise of the Incus host, enabling persistent access, data exfiltration, or further lateral movement within the network.

Attack Chain

Initial Setup (Attacker): The attacker creates a local Incus instance (e.g., images:debian/trixie) in an unrestricted project on their own system.
Malicious Hook Injection: The attacker injects a malicious low-level hook into the local Incus instance's configuration, specifically using raw.lxc or raw.qemu. For example, incus config set rce-raw-lxc raw.lxc='lxc.hook.pre-start = /bin/sh -c "/bin/id >/lxc-hook-prestart"'.
Snapshot Creation: A snapshot of the now-malicious local instance is created (e.g., incus snapshot create rce-raw-lxc snap0). This snapshot captures the injected malicious hook.
Hook Removal (Optional but Recommended): The attacker removes the raw.lxc configuration from the local instance to allow for transfer to the restricted project without immediate detection or conflict.
Instance Transfer: The malicious instance with its snapshot is moved from the attacker's local, unrestricted environment to a remote Incus server's restricted project (e.g., incus move rce-raw-lxc rem: --mode push).
Snapshot Restoration: The attacker restores the malicious snapshot within the restricted project on the remote Incus server (e.g., incus snapshot restore rem:rce-raw-lxc snap0). Despite restricted.containers.lowlevel=block being active on the remote project, the snapshot restoration process bypasses this control.
Command Execution: Upon starting the instance from the restored snapshot (e.g., incus start rem:rce-raw-lxc), the pre-start hook embedded in the snapshot executes the arbitrary command (e.g., /bin/id) on the Incus host with root privileges.

Impact

Successful exploitation of CVE-2026-48751 leads to a complete bypass of Incus project restrictions, specifically the restricted.containers.lowlevel=block setting designed to prevent such abuses. This directly results in arbitrary command execution on the underlying Incus server, granting an attacker root privileges. Such compromise allows for full control over the host system, potentially enabling further network infiltration, data exfiltration, service disruption, or the deployment of additional malicious payloads. While specific victim counts are not available, all Incus instances running vulnerable versions prior to 7.2.0 are at risk, particularly those hosting untrusted containers or users in restricted projects.

Recommendation

Immediately patch Incus instances to version 7.2.0 or later to remediate CVE-2026-48751.
Deploy the provided Sigma rule to detect attempts to configure low-level Incus hooks, which indicates potential exploitation of CVE-2026-48751.
Enable comprehensive process_creation logging for Linux systems to capture incus command executions and the execution of arbitrary commands.

Incus Argument Injection Vulnerability Leads to Arbitrary File Write and Command Execution

hello@craftedsignal.io — Fri, 03 Jul 2026 10:35:11 +0000

A critical vulnerability, CVE-2026-48755, affects Incus versions prior to 7.2.0, stemming from an argument injection flaw in its backup compression algorithm processing. The flaw allows an authenticated attacker to manipulate the compression_algorithm parameter, injecting arbitrary command-line arguments into the zstd compressor execution. This enables an arbitrary file write (AFW) operation on the host system where Incus is running. Attackers can leverage this AFW to write malicious content to sensitive locations, such as cron job directories (/etc/cron.d/), thereby achieving arbitrary command execution (ACE). This vulnerability is particularly dangerous as it provides a pathway from a compromised Incus instance to full system compromise of the host. Defenders should prioritize patching and monitoring for suspicious zstd command executions and unexpected file writes in system configuration paths.

Attack Chain

An authenticated attacker (e.g., a user with Incus client certificate access to the API) gains control over an Incus instance.
The attacker uploads a malicious payload (e.g., a reverse shell script or system command) into the compromised Incus instance, accessible from the host filesystem.
The attacker crafts a malicious compression_algorithm string containing argument injection payloads, such as zstd -d -f --pass-through -o /etc/cron.d/incus-zstd-rce -- /var/lib/incus/.../payload.
The attacker initiates a direct backup request to the Incus API for the compromised instance, specifying the crafted malicious compression_algorithm.
Incus, due to improper validation, constructs and executes a command similar to exec.Command("zstd", "-c", "-d", "-f", "--pass-through", "-o", "/etc/cron.d/incus-zstd-rce", "--", "/var/lib/incus/.../payload").
The zstd command's argument injection leads to an arbitrary file write, copying the attacker-controlled payload from within the Incus instance to /etc/cron.d/incus-zstd-rce on the host system.
The newly created cron job on the host system is executed by the cron daemon at the specified interval, resulting in arbitrary command execution on the Incus host.
The executed command establishes persistence or performs further malicious actions, such as data exfiltration or deploying additional malware.

Impact

The successful exploitation of CVE-2026-48755 leads to an arbitrary file write on the host operating system, which attackers can immediately leverage for arbitrary command execution. This allows a privileged user within an Incus instance to escalate privileges to root on the underlying host, circumventing containerization. Such a compromise grants the attacker full control over the Incus host, potentially impacting all other instances running on that server, and facilitating lateral movement within the network. This vulnerability affects Incus users running versions prior to 7.2.0, with potential for widespread compromise in environments where Incus is used for virtualization or container management.

Recommendation

Patch CVE-2026-48755 by upgrading all Incus installations to version 7.2.0 or higher immediately.
Deploy the provided Sigma rule "CVE-2026-48755: Incus Zstd Argument Injection Attempt" to your SIEM to detect suspicious execution of zstd with potential argument injection patterns.
Enable process_creation logging for Linux systems to capture command-line arguments of processes like zstd.
Monitor for the creation of new files in system cron directories, specifically /etc/cron.d/incus-zstd-rce, using file integrity monitoring or file_event logging, as this indicates a successful arbitrary file write.
Block the arbitrary file write target /etc/cron.d/incus-zstd-rce from being created by non-system processes if possible, or create a file_event rule to alert on its creation.

Incus Client Arbitrary File Write via Malicious Image Hash (CVE-2026-48769)

hello@craftedsignal.io — Fri, 03 Jul 2026 10:34:05 +0000

A critical arbitrary file write vulnerability, tracked as CVE-2026-48769, affects the Incus client daemon (incusd) versions prior to 7.2.0. This flaw stems from improper validation of the Incus-Image-Hash HTTP header when incusd imports an image from a remote URL. A malicious Incus image server can craft this header to include path traversal sequences (e.g., ../../../../etc/cron.d/), tricking incusd into writing an arbitrary file to a sensitive location on the host system with root privileges. By leveraging this to create a cron job (e.g., /etc/cron.d/incus-direct-image-url-rce), an attacker can achieve arbitrary command execution as root, leading to full system compromise and privilege escalation. This vulnerability poses a significant risk to Incus environments where image imports from untrusted sources are permitted.

Attack Chain

An attacker sets up a malicious Incus image server controlled by them.
The victim's Incus server (incusd daemon) is instructed to import an image using a user-supplied URL pointing to the attacker-controlled server (e.g., via incus image import ).
incusd initiates a HEAD request to the attacker's server to retrieve image metadata.
The malicious server responds with a crafted Incus-Image-Hash HTTP header containing a path traversal sequence (e.g., ../../../../etc/cron.d/incus-direct-image-url-rce) and an Incus-Image-URL header pointing to the malicious payload.
incusd processes these headers, and its imageDownload() function constructs a file path by combining /var/lib/incus/images/ with the attacker-supplied hash. Due to the path traversal, this resolves to a sensitive system path, such as /etc/cron.d/incus-direct-image-url-rce.
incusd invokes os.Create() on this crafted path, creating the arbitrary file /etc/cron.d/incus-direct-image-url-rce with root privileges.
incusd then makes a GET request to the Incus-Image-URL provided by the attacker and writes the malicious content (e.g., a cron job command * * * * * root /bin/sh -c "id > /tmp/incus-direct-image-url-rce") into the newly created file.
The host system's cron daemon subsequently executes the newly installed cron job, resulting in arbitrary command execution as root, enabling the attacker to gain full control over the Incus server.

Impact

Successful exploitation of CVE-2026-48769 allows an attacker to achieve an arbitrary file write on the Incus host system with root privileges. This directly leads to arbitrary command execution by writing malicious cron jobs or other configuration files, effectively compromising the entire server. This includes potential for data exfiltration, further lateral movement, or installation of persistent backdoors. Systems running Incus versions prior to 7.2.0 that import images from untrusted sources are at severe risk of compromise. While no specific victim counts are detailed, any organization utilizing vulnerable Incus deployments is susceptible.

Recommendation

Patch CVE-2026-48769 immediately by upgrading Incus to version 7.2.0 or later on all affected Linux servers.
Deploy the Sigma rule in this brief to your SIEM to detect suspicious file creations by the incusd process in sensitive system directories.
Implement strict controls over which Incus image servers are trusted and limit the ability of non-administrative users to import images from arbitrary URLs.
Enable comprehensive file system logging (e.g., auditd for Linux) to detect unexpected file creations or modifications in sensitive directories like /etc/cron.d/.