CVE-2026-48769: Incus Container Manager RCE Vulnerability

CVE-2026-48769 Overview

CVE-2026-48769 is an input validation flaw [CWE-20] in Incus, a system container and virtual machine manager maintained by the Linux Containers project. The vulnerability affects all versions of the Incus client prior to 7.2.0. A malicious image server can return a crafted Incus-Image-Hash HTTP response header that triggers an arbitrary file write on the client host. Because the Incus daemon commonly runs with elevated privileges, attackers can escalate the primitive into arbitrary command execution as root on the server pulling the image.

Critical Impact
A hostile image registry can achieve root-level remote code execution against any Incus deployment that fetches an image from it, compromising containers, virtual machines, and the underlying host.

Affected Products

Incus client versions prior to 7.2.0
Incus servers pulling images from untrusted or attacker-controlled image servers
Downstream distributions bundling vulnerable Incus releases

Discovery Timeline

2026-08-21 - CVE-2026-48769 published to the National Vulnerability Database
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-48769

Vulnerability Analysis

Incus supports fetching container and virtual machine images from remote image servers over HTTP. During this exchange, the server returns metadata about the image, including a hash value delivered in the Incus-Image-Hash response header. The Incus client trusts this header value when writing image content to local storage.

Because the client fails to validate the header, an attacker controlling the image server can supply values that break out of the expected filename or path context. The resulting arbitrary file write lands in a location the Incus daemon can execute or interpret, converting a file write primitive into root command execution on the host. This maps to Improper Input Validation [CWE-20].

Root Cause

The Incus client treats the Incus-Image-Hash header as trusted input and uses it to construct filesystem paths without sanitization. No allow-listing, canonicalization, or length enforcement is applied before the value influences file operations executed under the daemon's privilege context.

Attack Vector

Exploitation requires a victim to pull an image from an attacker-controlled server, or a legitimate server compromised by the attacker. The attacker returns a manipulated Incus-Image-Hash header in the HTTP response. Once processed by the vulnerable client, the crafted header directs the write to an attacker-chosen destination, yielding code execution as root. The attack is network-reachable and requires no user interaction beyond initiating a standard image pull.

Refer to the GitHub Security Advisory GHSA-f6m5-xw2g-xc4x for maintainer-provided technical details.

Detection Methods for CVE-2026-48769

Indicators of Compromise

HTTP responses from image servers containing unusual, path-like, or oversized values in the Incus-Image-Hash header.
Unexpected files appearing under Incus-managed directories or system paths shortly after an incus image pull operation.
New or modified executables, systemd units, or cron entries created by the Incus daemon process.
Outbound image pulls to image servers not present in the organization's approved registry list.

Detection Strategies

Inspect Incus client logs for image pull operations that reference untrusted or newly observed remote servers.
Monitor process ancestry for root-owned processes spawned by the Incus daemon shortly after image fetches.
Alert on file writes by the Incus daemon that occur outside its expected image storage directories.

Monitoring Recommendations

Baseline the set of image servers used across the environment and flag deviations at the network egress layer.
Capture and retain HTTP response headers from image server traffic for retrospective hunting.
Correlate Incus daemon activity with endpoint telemetry to detect post-exploitation behavior such as persistence installation or credential access.

How to Mitigate CVE-2026-48769

Immediate Actions Required

Upgrade the Incus client and server to version 7.2.0 or later on every host that performs image operations.
Restrict image pulls to trusted, authenticated image servers under organizational control until patching is complete.
Audit recent image pull activity for connections to unknown remote image servers and investigate any anomalies.
Review host filesystem integrity on Incus servers that pulled images from third-party sources prior to patching.

Patch Information

The Incus maintainers fixed the issue in version 7.2.0. The patch validates the Incus-Image-Hash header before it influences filesystem operations. Administrators should apply the vendor update from the Incus GitHub Security Advisory and confirm all clients and servers report the patched version.

Workarounds

Block outbound network access from Incus hosts to any image server that is not explicitly allow-listed.
Configure Incus to use only internal, cryptographically authenticated image mirrors during the remediation window.
Run Incus daemons with the least privilege required and isolate them from sensitive host paths where operationally feasible.

bash

# Verify the installed Incus version is patched
incus version

# Example allow-list enforcement at the host firewall (adjust to your environment)
# Replace mirror.internal.example with your trusted image server
iptables -A OUTPUT -m owner --uid-owner incus -d mirror.internal.example -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner incus -j REJECT