CVE-2026-63343
published 2026-08-21CVE-2026-63343: Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a `metadata.yaml` symlink pointing to an…
PriorityP266critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
EPSS
0.48%
40.4th percentile
Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a `metadata.yaml` symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadata API. The `exec-output` and `templates/` paths were patched in a prior release using `Lstat` rejection and `os.OpenRoot` confinement; `metadata.yaml` was not included in either patch and remains exploitable. Version 7.3.0 patches the issue.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| lxc | incus | < 7.3.0 | 7.3.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No advisories linked to this vulnerability.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-63343 incus: Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root [fedora-all]
bugzilla·2026-09-10·CVSS 9.9
CVE-2026-63343 [CRITICAL] CVE-2026-63343 incus: Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root [fedora-all]
CVE-2026-63343 incus: Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a `metadata.yaml` symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadata API. The `exec-output` and `templates/` paths were patched in a prior release using `Lstat` rejection and `os.OpenRoot` confinement; `metadata.yaml` was not incl
Bugzilla
CVE-2026-63343 incus: Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root
bugzilla·2026-08-21·CVSS 9.9
CVE-2026-63343 [CRITICAL] CVE-2026-63343 incus: Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root
CVE-2026-63343 incus: Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root
Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a `metadata.yaml` symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadata API. The `exec-output` and `templates/` paths were patched in a prior release using `Lstat` rejection and `os.OpenRoot` confinement; `metadata.yaml` was not included in either patch and remains exploitable. Version 7.3.0 patches the issue.
2026-08-21
Published