CVE-2026-48751 Overview
CVE-2026-48751 is a missing authorization vulnerability [CWE-862] in Incus, a system container and virtual machine manager. Instance snapshots ignore the restricted.containers.lowlevel=block setting. Restricted users can abuse lowlevel hooks such as raw.lxc and raw.qemu during snapshot operations. This grants arbitrary command execution on the Incus server host. Version 7.2.0 patches the issue.
Critical Impact
A low-privileged Incus user can bypass the lowlevel restriction and execute arbitrary commands on the underlying Incus server, resulting in full host compromise across confidentiality, integrity, and availability.
Affected Products
- Incus system container and virtual machine manager
- All Incus versions prior to 7.2.0
- Multi-tenant Incus deployments relying on restricted.containers.lowlevel=block
Discovery Timeline
- 2026-08-21 - CVE-2026-48751 published to NVD
- 2026-08-21 - Last updated in NVD database
Technical Details for CVE-2026-48751
Vulnerability Analysis
Incus enforces multi-tenant isolation through project-level restrictions. The restricted.containers.lowlevel=block setting is intended to prevent restricted users from configuring lowlevel instance options that interact directly with the underlying LXC or QEMU runtime. These lowlevel options accept raw configuration passed to the hypervisor and can execute commands on the host.
The vulnerability stems from the snapshot code path failing to apply this restriction. When a restricted user creates or restores an instance snapshot, the enforcement logic that validates raw.lxc, raw.qemu, and related keys is bypassed. This produces an authorization bypass that allows privilege escalation from a restricted project user to the Incus daemon context on the host.
Because the Incus daemon runs with elevated privileges, arbitrary command execution through raw.lxc or raw.qemu compromises the host operating system. The scope change reflects that exploitation crosses the trust boundary from a restricted tenant to the underlying server.
Root Cause
The snapshot handling code does not evaluate the restricted.containers.lowlevel project setting before accepting lowlevel configuration keys. This is a classic missing authorization check [CWE-862] where a permission enforced on the primary object lifecycle is not consistently enforced on secondary lifecycle operations.
Attack Vector
An authenticated user with permission to manage instances within a restricted project supplies lowlevel hook values such as raw.lxc or raw.qemu during snapshot operations. The Incus daemon accepts the configuration and passes it to the container or virtual machine runtime, which executes attacker-controlled commands in the daemon's execution context on the host. Detailed exploitation is documented in the GitHub Security Advisory GHSA-48q5-w887-33wv.
Detection Methods for CVE-2026-48751
Indicators of Compromise
- Snapshot operations that reference raw.lxc or raw.qemu configuration keys originating from restricted project users
- Unexpected child processes spawned by the Incus daemon (incusd) outside normal container or VM lifecycle events
- Modifications to instance configuration containing lowlevel hooks not present in the parent instance definition
- Outbound network connections initiated by processes parented to the Incus daemon on hosts running versions prior to 7.2.0
Detection Strategies
- Audit Incus API and CLI logs for snapshot create and restore actions that include raw.* configuration keys
- Alert on instance configuration changes that introduce raw.lxc, raw.qemu, or raw.idmap fields following a snapshot event
- Correlate restricted user identities with snapshot activity in the Incus event stream
Monitoring Recommendations
- Enable verbose logging on the Incus daemon and forward events to a centralized log platform for retention and analysis
- Baseline expected process trees for incusd and alert on deviations such as shell interpreters or network utilities
- Review project settings periodically to confirm restricted.containers.lowlevel=block is applied and effective after upgrading
How to Mitigate CVE-2026-48751
Immediate Actions Required
- Upgrade all Incus servers to version 7.2.0 or later, which contains the authorization fix
- Inventory projects using restricted.containers.lowlevel=block and review recent snapshot activity for abuse
- Rotate credentials and secrets stored on Incus hosts if compromise is suspected
Patch Information
The Incus maintainers released version 7.2.0 to patch this issue. Refer to the GitHub Security Advisory GHSA-48q5-w887-33wv for release details and remediation guidance.
Workarounds
- Revoke instance management permissions from untrusted project users until the patch is deployed
- Disable snapshot creation and restore operations for restricted projects where feasible
- Restrict network access to the Incus API endpoint to trusted administrative networks only
# Verify installed Incus version and upgrade
incus --version
# Debian/Ubuntu example
sudo apt update && sudo apt install --only-upgrade incus
# Confirm version 7.2.0 or later
incus --version
# Review project restrictions
incus project show <project-name> | grep restricted.containers.lowlevel
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
