Lxc Incus vulnerabilities

CVE-2026-55621 [HIGH] CWE-284 CVE-2026-55621: Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorizati Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to a

CVE-2026-55622 [HIGH] CWE-284 CVE-2026-55622: Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorizati Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new project. This issue could allow an attacker to access secrets

CVE-2026-115376 [HIGH] CWE-284 CVE-2026-115376: Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type. Attackers can send crafted POST requests to the custom volumes endpoint with a chosen source.project to copy and read other projects' volumes, snapshots, and configuration.

CVE-2026-33711 [HIGH] CWE-61 CVE-2026-33711: Incus is a system container and virtual machine manager. Incus provides an API to retrieve VM screen Incus is a system container and virtual machine manager. Incus provides an API to retrieve VM screenshots. That API relies on the use of a temporary file for QEMU to write the screenshot to which is then picked up and sent to the user prior to deletion. As versions prior to 6.23.0 use predictable paths under /tmp for this, an attacker with local access

CVE-2025-64507 [HIGH] CWE-269 CVE-2025-64507: Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.1 Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.19.0 affects any Incus user in an environment where an unprivileged user may have root access to a container with an attached custom storage volume that has the `security.shifted` property set to `true` as well as access to the host as an unprivileged us

CVE-2026-115371 [HIGH] CWE-522 CVE-2026-115371: Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorizat Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete objects in those buckets.

CVE-2026-115374 [HIGH] CWE-347 CVE-2026-115374: Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built- Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz-* headers. Attackers can add an unsigned X-Amz-Copy-Source header to a presigned upload URL to copy other bucket objects onto the granted key, disclosing their contents and ETags.

CVE-2026-24767 [MEDIUM] CWE-918 CVE-2026-24767: NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a blind Server- NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a blind Server-Side Request Forgery (SSRF) vulnerability exists in the `uploadViaURL` functionality due to an unprotected `HEAD` request. While the subsequent file retrieval logic correctly enforces SSRF protections, the initial metadata request executes without val

CVE-2026-115373 [MEDIUM] CWE-862 CVE-2026-115373: Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vuln Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients read operations in other projects. Attackers holding a restricted certificate and a known operation UUID can retrieve command lines, environment secrets, websocket secrets,

CVE-2025-52890 [HIGH] CWE-863 CVE-2025-52890: Incus is a system container and virtual machine manager. When using an ACL on a device connected to Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus versions 6.12 and 6.13generates nftables rules that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to ARP spoofing on the bridge and to fully spoof anothe

CVE-2026-33743 [MEDIUM] CWE-770 CVE-2026-33743: Incus is a system container and virtual machine manager. Prior to version 6.23.0, a specially crafte Incus is a system container and virtual machine manager. Prior to version 6.23.0, a specially crafted storage bucket backup can be used by an user with access to Incus' storage bucket feature to crash the Incus daemon. Repeated use of this attack can be used to keep the server offline causing a denial of service of the control plane API. This does n

CVE-2026-115378 [MEDIUM] CWE-59 CVE-2026-115378: Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vuln Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious incus-agent to escape the target directory during incus file pull -r. Attackers with root in a virtual machine can return duplicate entries reported first as symlinks then as files or directo

CVE-2026-41684 [MEDIUM] CWE-476 CVE-2026-41684: Incus is a system container and virtual machine manager. Prior to version 7.0.0, backup.GetInfo() tr Incus is a system container and virtual machine manager. Prior to version 7.0.0, backup.GetInfo() trusts the inline backup/index.yaml config when present and only falls back to parsing the legacy backup/container/backup.yaml file if result.Config == nil. As a result, an archive can carry a valid inline config that passes the initial import preflight

CVE-2026-40251 [MEDIUM] CWE-129 CVE-2026-40251: Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validatio Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authenticated user with access to the storage volume feature to cause the Incus daemon to crash. The backup restore subsystem contains an out-of-bounds panic vulnerability caused by an invalid bound

CVE-2026-40195 [MEDIUM] CWE-476 CVE-2026-40195: Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validatio Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage bucket import logic allows an authenticated user with access to the storage bucket feature to cause the Incus daemon to crash. The vulnerability is present in the backup metadata handling logic, where the daemon processes the in

CVE-2026-41647 [MEDIUM] CWE-476 CVE-2026-41647: Incus is a system container and virtual machine manager. Prior to version 7.0.0, a missing error han Incus is a system container and virtual machine manager. Prior to version 7.0.0, a missing error handling could lead an authenticated Incus user to cause a daemon crash through the import of a truncated storage bucket backup file. This issue has been patched in version 7.0.0.

CVE-2026-40197 [MEDIUM] CWE-476 CVE-2026-40197: Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validatio Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authenticated user with access to the storage volume feature to cause the Incus daemon to crash. The custom volume backup import subsystem contains a nil-pointer dereference vulnerability during imp

CVE-2026-41648 [MEDIUM] CWE-770 CVE-2026-41648: Incus is a system container and virtual machine manager. Prior to version 7.0.0, user provided image Incus is a system container and virtual machine manager. Prior to version 7.0.0, user provided image and backup tarballs would be unpacked and YAML files parsed without any size restrictions. This was making it easy for an authenticated user to provide a crafted image or backup tarball that when parsed by Incus would lead to a very large YAML docume

CVE-2026-40243 [MEDIUM] CWE-295 CVE-2026-40243: Incus is a system container and virtual machine manager. In versions before 7.0.0, broken TLS valida Incus is a system container and virtual machine manager. In versions before 7.0.0, broken TLS validation logic in the OVN database connection logic can allow connections to an attacker's OVN database. The OVN client implementations disable Go standard TLS server verification and replace it with custom peer-certificate verification logic. That replac

CVE-2026-115370 [MEDIUM] CWE-863 CVE-2026-115370: Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an existing instance to make the server open outbound TLS w