CVE-2026-48755: Incus Container Manager RCE Vulnerability

CVE-2026-48755 Overview

CVE-2026-48755 is an argument injection vulnerability in Incus, an open-source system container and virtual machine manager. The flaw affects all versions prior to 7.1.0 and stems from improper validation of the user-supplied backup compression algorithm parameter [CWE-20]. An authenticated attacker with low privileges can inject arguments into the constructed command line used during backup operations. Successful exploitation results in arbitrary file writes on the host, which can escalate to arbitrary command execution. The vulnerability is network-exploitable and impacts the confidentiality, integrity, and availability of the host system.

Critical Impact
Argument injection through the backup compression algorithm parameter enables arbitrary file writes on the Incus host, providing a path to full host compromise from a low-privileged authenticated context.

Affected Products

Incus system container and virtual machine manager, all versions prior to 7.1.0
Deployments exposing the Incus API to untrusted or semi-trusted users
Multi-tenant container hosting environments running vulnerable Incus builds

Discovery Timeline

2026-08-21 - CVE-2026-48755 published to the National Vulnerability Database
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-48755

Vulnerability Analysis

Incus builds a command line to invoke a compression tool when producing instance or volume backups. The compression algorithm is provided by the user through the backup API or configuration. Incus fails to validate this input against an allow-list of expected algorithm names. An attacker who supplies a crafted value can inject additional command-line arguments into the invocation. Because many compression utilities accept flags that redirect output or read arbitrary input files, the injection converts a benign backup call into a primitive for writing attacker-controlled data to attacker-chosen paths on the host filesystem.

Root Cause

The root cause is improper input validation [CWE-20] of the backup compression algorithm parameter before it is passed to the process execution layer. Incus treats the value as a trusted token and appends it directly to the compression command arguments. No allow-list or shell-argument sanitization is enforced, so option-style tokens such as those beginning with a dash are accepted and interpreted by the downstream binary as flags rather than as an algorithm identifier.

Attack Vector

The attack requires network access to the Incus API and low-privileged authentication. The attacker initiates a backup operation and sets the compression algorithm field to a value that includes additional arguments understood by the target compression utility. When Incus executes the command, the injected flags cause the utility to write files to attacker-controlled paths on the host. Writing to systemd unit paths, cron directories, or authorized_keys files converts the primitive into arbitrary command execution as the Incus service account, typically root. The scope change reflected in the scoring indicates that compromise extends beyond the container boundary into the host itself.

No public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-v6mj-8pf4-hhw4 for vendor technical details.

Detection Methods for CVE-2026-48755

Indicators of Compromise

Backup API requests whose compression algorithm field contains characters outside the alphanumeric set, particularly leading dashes or path separators
Unexpected files appearing under sensitive host directories such as /etc/systemd/system/, /etc/cron.d/, or /root/.ssh/ shortly after Incus backup operations
Incus daemon spawning compression utilities with argument lists that reference filesystem paths outside the configured backup directory

Detection Strategies

Inspect Incus API audit logs for backup requests and flag any compression_algorithm value that does not match a known algorithm such as gzip, bzip2, xz, zstd, or lzo
Correlate child-process telemetry from the Incus daemon with expected backup workflows, alerting on unusual flags passed to compression binaries
Monitor file integrity across host paths that provide code execution primitives, including init and scheduler configuration directories

Monitoring Recommendations

Enable verbose audit logging on the Incus API and forward events to a centralized log platform for retention and correlation
Track process ancestry so that incusd invocations of gzip, zstd, xz, and similar tools can be reviewed for anomalous arguments
Alert on new privileged files created by the Incus service account outside its expected working directories

How to Mitigate CVE-2026-48755

Immediate Actions Required

Upgrade Incus to version 7.1.0 or later on all hosts running the daemon
Restrict Incus API access to trusted administrative networks and enforce least privilege on API certificates and tokens
Review recent backup activity for suspicious compression algorithm values and inspect the host for unauthorized file writes

Patch Information

The Incus project released version 7.1.0, which validates the backup compression algorithm parameter and blocks argument injection. See the GitHub Security Advisory GHSA-v6mj-8pf4-hhw4 for the official fix and release notes. Apply the update through your distribution package manager or the upstream Incus release channel.

Workarounds

If immediate patching is not possible, revoke backup permissions from non-administrative users through Incus role-based access control
Place the Incus API behind an authenticating reverse proxy that filters or rejects backup requests containing non-alphanumeric compression algorithm values
Run the Incus daemon under systemd hardening options that constrain writable paths, reducing the impact of a successful file write primitive

bash

# Configuration example
# Verify the installed Incus version and upgrade if needed
incus version
sudo apt update && sudo apt install --only-upgrade incus

# Restrict backup capability at the project or user level
incus auth group permission add <group> project <project> can_view
# Remove overly broad operator/admin permissions from untrusted identities
incus auth group permission remove <group> server admin