What is the CVSS score of CVE-2026-48751?

CVE-2026-48751 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Incus are affected by CVE-2026-48751?

Incus container platform versions before 7.2.0 contain a critical privilege escalation flaw that allows authenticated low-privileged users to gain root access to the host system by bypassing project…. A patch is available.

Is there a public PoC exploit available for CVE-2026-48751?

Yes, a public proof-of-concept exploit is available for CVE-2026-48751. Prioritise patching immediately. EPSS: 0.7%.

How to fix or mitigate CVE-2026-48751?

WITHIN 24 HOURS: Inventory all Incus installations and identify systems running versions before 7.2.0 with exposure to non-administrator users. WITHIN 7 DAYS: Restrict project creation and snapshot restoration privileges to fully trusted administrators only; disable raw.lxc and raw.qemu configuration options; audit existing snapshots for malicious low-level hooks. WITHIN 30 DAYS: Monitor Incus project for version 7.2.0 release announcement; conduct testing in isolated environment and prepare staged upgrade deployment.

Incus CVE-2026-48751

EUVD-2026-63978 CRITICAL

Missing Authorization (CWE-862)

2026-06-26 https://github.com/lxc/incus

GHSA-48q5-w887-33wv

Authentication Bypass Debian

9.9

CVSS 3.1 · Vendor: https://github.com/lxc/incus

Severity by source

Vendor (https://github.com/lxc/incus) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable API with low-privilege project access (PR:L), low complexity; container-to-host escape changes scope (S:C) and yields root command execution, so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Primary rating from Vendor (https://github.com/lxc/incus).

CVSS VectorVendor: https://github.com/lxc/incus

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 26, 2026 - 19:20 vuln.today

Analysis Generated

Jun 26, 2026 - 19:20 vuln.today

CVE Published

Jun 26, 2026 - 18:33 github-advisory

CRITICAL 9.9

DescriptionCVE.org

Summary

Instance snapshots ignore the restricted.containers.lowlevel=block setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as raw.lxc and raw.qemu.

Details

Instance snapshots ignore the restricted.containers.lowlevel=block setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as raw.lxc and raw.qemu.

As snapshots can be moved from one server to another, a malicious instance+snapshot can be crafted locally, moved to a restricted project and the snapshot restored for arbitrary command execution.

In practice, this allows a malicious actor to execute arbitrary commands on the host with root privileges.

PoC

# remote, restricted
incus project set rem:project restricted.true
incus project set rem:project restricted.containers.lowlevel=block
# locally, unrestricted project
incus init images:debian/trixie rce-raw-lxc
incus config set rce-raw-lxc raw.lxc='lxc.hook.pre-start = /bin/sh -c "/bin/id >/lxc-hook-prestart"'
incus snapshot create rce-raw-lxc snap0
#> allow transfer to restricted project
incus config unset rce-raw-lxc raw.lxc
# locally, transfer and trigger
incus move rce-raw-lxc rem: --mode push
incus snapshot restore rem:rce-raw-lxc snap0
incus start rem:rce-raw-lxc

Impact

Bypass of project restrictions.
Arbitrary command execution on the Incus server.

AnalysisAI

Privilege escalation and project-restriction bypass in Incus before 7.2.0 lets a low-privileged user with access to an unrestricted project craft an instance whose snapshot carries malicious low-level hooks (raw.lxc/raw.qemu), then move and restore it into a project protected by restricted.containers.lowlevel=block, executing arbitrary commands on the host as root. The snapshot-restore path fails to re-enforce the lowlevel restriction, so the security control is silently bypassed. Publicly available exploit code exists (full PoC published in the vendor GHSA advisory); there is no public evidence of active exploitation.

Technical ContextAI

Incus is a system container and virtual-machine manager (a community fork of Canonical's LXD), written in Go; the affected component is the incusd daemon (pkg:go/github.com/lxc/incus/v7/cmd/incusd). Incus exposes 'low-level' passthrough configuration keys - raw.lxc and raw.qemu - that inject raw directives into the underlying LXC/QEMU runtime, including lifecycle hooks such as lxc.hook.pre-start that run on the host. To contain this power, projects can set restricted=true plus restricted.containers.lowlevel=block to forbid these keys. The root cause is CWE-862 (Missing Authorization): the snapshot restore/import code path does not validate restored low-level configuration against the destination project's restrictions, so a value blocked at config-set time is accepted when it arrives embedded inside a snapshot. Because hooks execute in the host context with root privileges, this is effectively a container-to-host escape gated only by the bypassed policy check.

RemediationAI

Vendor-released patch: upgrade Incus to 7.2.0 or later, which re-enforces the lowlevel restriction across the snapshot restore/import path; this is the primary and recommended fix (see https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv). Until you can patch, reduce exposure by restricting who can create and especially move/import instances and snapshots into restricted projects - limit move/migration permissions to trusted administrators, since the attack hinges on transferring an externally crafted instance+snapshot into the protected project. As an additional compensating control, scrutinize or block cross-project and cross-server instance moves into projects that rely on restricted.containers.lowlevel=block, and audit existing snapshots for raw.lxc/raw.qemu hook content before restoring them; the trade-off is reduced migration flexibility and added operational overhead. Note that setting restricted.containers.lowlevel=block alone does NOT mitigate this issue on unpatched versions, which is the core of the bug.