CVE-2026-63125: Incus Privilege Escalation Vulnerability

CVE-2026-63125 Overview

CVE-2026-63125 is a symlink-following vulnerability in Incus, the open source system container and virtual machine manager maintained by the LXC project. An unprivileged, project-confined Incus user holding can_create_images and can_create_instances permissions can execute arbitrary code as root on the host. The flaw stems from the daemon following a symlink at backup.yaml inside a crafted image, allowing the attacker to redirect writes to arbitrary host files. Incus version 7.3.0 patches the issue. The vulnerability is tracked under CWE-59: Improper Link Resolution Before File Access.

Critical Impact
A low-privilege TLS/RBAC identity can escalate to root on the Incus host, resulting in full host compromise and breakout from project confinement.

Affected Products

Incus system container and virtual machine manager
All Incus versions prior to 7.3.0
Hosts running the Incus root daemon that accept image uploads or instance creation from non-admin identities

Discovery Timeline

2026-08-21 - CVE-2026-63125 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-63125

Vulnerability Analysis

The vulnerability is a classic symlink-following flaw in Incus's instance backup file handling. Incus stores per-instance metadata in a file named backup.yaml inside the instance directory. When a user imports a crafted image, that image can ship backup.yaml as a symbolic link pointing to any absolute path on the host filesystem.

When the Incus daemon later regenerates or writes the instance's backup file, it opens the target path without verifying whether it is a regular file or a symlink. Because the daemon runs as root, the write follows the attacker-controlled symlink and modifies the target file with root privileges. Attackers can overwrite files such as /etc/cron.d/ entries, systemd unit files, or authorized SSH keys to achieve arbitrary code execution.

The attack requires only a non-admin TLS or RBAC identity scoped to a single project, provided that identity has can_create_images and can_create_instances. Project confinement, which is intended to isolate tenants, does not prevent the escape.

Root Cause

The root cause is missing symlink resolution safeguards when the root-privileged daemon opens backup.yaml for writing. Incus did not use O_NOFOLLOW, path validation, or a safe file replacement primitive before writing. This is the pattern described by CWE-59, improper link resolution before file access.

Attack Vector

An authenticated remote attacker crafts a malicious image tarball in which backup.yaml is a symlink to a sensitive host path. The attacker uploads the image and creates an instance from it using the Incus API. When the daemon writes instance state to backup.yaml, the write is redirected to the attacker's chosen host file. Arbitrary content controlled by the attacker lands in that file with root ownership, yielding code execution outside the project boundary.

Refer to the Incus GitHub Security Advisory GHSA-6rqx-22hc-qm36 for the maintainer's technical description.

Detection Methods for CVE-2026-63125

Indicators of Compromise

Presence of a symbolic link named backup.yaml inside any instance directory under the Incus storage path.
Recent modifications to host files such as /etc/cron.d/*, /etc/systemd/system/*.service, or /root/.ssh/authorized_keys correlated with Incus image imports or instance creation events.
Incus audit log entries showing image uploads or instance creations from non-admin TLS/RBAC identities followed by unexpected root-owned file changes.

Detection Strategies

Inspect all imported images for backup.yaml entries that are symbolic links rather than regular files.
Correlate Incus API calls (POST /1.0/images, POST /1.0/instances) from project-confined identities with filesystem write telemetry on the host.
Alert on writes to sensitive host paths performed by the Incus daemon process outside its expected storage directories.

Monitoring Recommendations

Enable file integrity monitoring on /etc, /root/.ssh, and systemd unit directories on all Incus hosts.
Ingest Incus daemon logs and API audit events into a centralized data lake for correlation with endpoint telemetry.
Track the Incus daemon version across the fleet and alert when hosts run versions prior to 7.3.0.

How to Mitigate CVE-2026-63125

Immediate Actions Required

Upgrade Incus to version 7.3.0 or later on every host running the daemon.
Audit all non-admin TLS and RBAC identities and remove can_create_images or can_create_instances permissions where they are not required.
Review recently imported images and destroy any instance whose backup.yaml is a symbolic link.
Rotate host credentials and SSH keys on any Incus host where compromise cannot be ruled out.

Patch Information

The LXC project fixed the issue in Incus 7.3.0. The patch ensures the daemon rejects or safely handles symlinked backup.yaml entries when writing instance state. Details are published in the Incus GitHub Security Advisory GHSA-6rqx-22hc-qm36.

Workarounds

Restrict image and instance creation to fully trusted administrative identities until the patch is deployed.
Disable remote API access from untrusted networks and require TLS client certificate allow-listing.
Reject or quarantine imported image tarballs that contain a backup.yaml symlink through a pre-import validation script.

bash

# Verify installed Incus version and identify pre-7.3.0 hosts
incus version

# Inspect image tarballs before import for a symlinked backup.yaml
tar -tvf suspect-image.tar.xz | grep -E '(^l|backup\.yaml)'

# List identities and their permissions; remove risky grants
incus auth identity list
incus auth group permission remove <group> project <project> can_create_images
incus auth group permission remove <group> project <project> can_create_instances