CVE-2026-48750: Incus Container Manager RCE Vulnerability

CVE-2026-48750 Overview

CVE-2026-48750 is a symlink-based file write vulnerability in Incus, an open-source system container and virtual machine manager maintained by the LXC project. The flaw resides in the record-output parameter of the /instances/$name/exec API endpoint. When invoked, the endpoint stores command output inside the instance's exec-output directory. If an attacker replaces exec-output with a symbolic link, Incus writes exec_UUID.stdout and exec_UUID.stderr files to arbitrary locations with attacker-controlled content. This primitive can be chained into arbitrary command execution on the host. Incus version 7.2.0 patches the issue [CWE-73].

Critical Impact
An authenticated actor with instance exec privileges can write arbitrary files outside the instance boundary and escalate to command execution on the Incus host.

Affected Products

Incus system container and virtual machine manager
Incus versions prior to 7.2.0
Deployments exposing the /instances/$name/exec REST endpoint

Discovery Timeline

2026-08-21 - CVE-2026-48750 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-48750

Vulnerability Analysis

Incus exposes an exec REST endpoint that runs commands inside a managed instance. When callers pass the record-output parameter, Incus captures the command's standard output and standard error streams to files in the exec-output directory belonging to that instance. The write operation does not validate whether exec-output is a regular directory or a symbolic link before following it.

Because Incus follows the link, the resulting .stdout and .stderr files land wherever the symlink points. The .stdout file carries attacker-controlled content derived from the executed command. This external control of file path (CWE-73) turns a benign logging feature into an arbitrary file write primitive against the host filesystem.

Root Cause

The underlying defect is missing validation of the exec-output path before Incus dereferences it. The service trusts that the path resolves to a directory under instance control. An attacker who can influence that path — for example by staging a symlink inside a shared or mounted location — redirects writes to sensitive host locations such as systemd unit directories, cron paths, or shell profile files.

Attack Vector

Exploitation requires network access to the Incus API and privileges sufficient to invoke exec on an instance with record-output enabled. The attacker prepares a symlink named exec-output that points to a writable directory on the host, then triggers an exec call whose stdout contains a chosen payload. Incus writes exec_UUID.stdout to the linked target. Dropping the file into an auto-executed path yields command execution as the Incus service account, typically root.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-73hr-m85f-64v9 for vendor technical detail.

Detection Methods for CVE-2026-48750

Indicators of Compromise

Unexpected exec_*.stdout or exec_*.stderr files appearing outside of an instance's normal exec-output directory tree.
Symbolic links named exec-output inside instance storage that resolve to host paths such as /etc/, /root/, or /var/spool/cron/.
Incus API requests to /instances/$name/exec that set record-output to true from non-administrative accounts.
New or modified files in auto-executed locations (systemd units, cron entries, shell rc files) whose contents mirror command output patterns.

Detection Strategies

Audit Incus daemon logs for exec calls with record-output enabled and correlate with subsequent filesystem writes on the host.
Run periodic filesystem scans that flag symlinks named exec-output in instance directories and report their resolved targets.
Baseline expected write locations for the Incus service user and alert on writes outside of that set.

Monitoring Recommendations

Forward Incus API access logs and Linux audit records for openat and symlinkat syscalls tied to the Incus process into a centralized analytics platform.
Monitor for privilege escalation patterns following an exec call: new setuid binaries, new services, or modifications to root-owned scripts.
Track version inventory of Incus deployments and alert on any host running a release below 7.2.0.

How to Mitigate CVE-2026-48750

Immediate Actions Required

Upgrade Incus to version 7.2.0 or later on every management host without delay.
Restrict access to the Incus REST API to trusted operators and internal networks only.
Review existing instance storage for symbolic links named exec-output and remove any that resolve outside the instance directory.
Rotate credentials and inspect host integrity on any system where suspicious exec activity is observed.

Patch Information

The Incus maintainers released version 7.2.0 with the fix. Refer to GitHub Security Advisory GHSA-73hr-m85f-64v9 for release notes and commit references. Package maintainers for Linux distributions should ship the patched version through standard channels.

Workarounds

Disable use of the record-output parameter in operational tooling until the upgrade is complete.
Limit which client certificates or API tokens are authorized to call /instances/$name/exec on production instances.
Enforce mandatory access control policies (AppArmor or SELinux) that constrain the Incus daemon's write scope to expected directories.

bash

# Verify the installed Incus version and upgrade
incus --version

# Debian/Ubuntu example
sudo apt update && sudo apt install --only-upgrade incus

# Confirm the API is reachable only to trusted networks
incus config show | grep -E 'core.https_address|core.trust_password'

# Audit instance storage for suspicious symlinks
sudo find /var/lib/incus/containers -maxdepth 3 -type l -name 'exec-output' -exec ls -l {} \;