EUVD-2026-63978
GHSA-48q5-w887-33wv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconAuthenticate to Incus with low-privilege project access
-
DeliveryCreate instance with malicious raw.lxc/raw.qemu hook in unrestricted project
-
ExploitSnapshot instance then unset raw key
-
InstallMove instance into restricted lowlevel-block project
-
C2Restore snapshot bypassing restriction check
-
ExecuteStart instance triggering host hook
-
ImpactArbitrary command execution as root on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated Incus user (CVSS PR:L) with permission to create instances in at least one unrestricted/permissive project and to move/migrate instances into a target project configured with restricted=true and restricted.containers.lowlevel=block - that restricted configuration is precisely the control being bypassed. The attacker must be able to craft an instance with a malicious raw.lxc (containers) or raw.qemu (VMs) low-level hook, snapshot it, transfer it, restore the snapshot, and start the instance. Limiting factors: it is not anonymous (valid project access is required), it depends on a multi-tenant deployment that uses restricted projects as a trust boundary, and it requires the ability to perform instance moves/imports into the restricted project; no end-user interaction or non-default platform is otherwise needed. |
| Impact | Signals are largely consistent and point to a genuine high priority. The CVSS 3.1 base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): network-reachable API, low complexity, only low privileges needed, scope-changed because the container boundary is crossed to compromise the host, with full confidentiality/integrity/availability impact. A complete, reliable PoC is published in the advisory, lowering the practical bar to exploitation. There is no CISA KEV listing and no EPSS value supplied, so widespread automated exploitation is not evidenced - appropriate given Incus's comparatively modest deployment footprint and the prerequisite of authenticated project access. The main caveat: this is an insider/multi-tenant threat - PR:L means the attacker must already hold a legitimate Incus account able to create and move instances; it is not an anonymous internet drive-by. For multi-tenant or shared Incus hosts relying on restricted projects for isolation, treat as critical; for single-admin deployments the marginal risk is lower since trusted admins already control the host. |
| Exploit ScenarioDerived | A tenant who holds a normal Incus account creates an instance in an unrestricted project, sets raw.lxc to a pre-start hook running an arbitrary command, snapshots it, then unsets the key so the instance can transfer. They move the instance to a project hardened with restricted.containers.lowlevel=block, restore the malicious snapshot, and start it - the hook fires and executes their command on the host as root. A working step-by-step PoC for exactly this flow is published in the advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 26, 2026
Privilege escalation and project-restriction bypass in Incus before 7.2.0 lets a low-privileged user with access to an unrestricted project craft an instance whose snapshot carries malicious low-level hooks (raw.lxc/raw.qemu), then move and restore it into a project protected by restricted.containers.lowlevel=block, executing arbitrary commands on the host as root. The snapshot-restore path fails to re-enforce the lowlevel restriction, so the security control is silently bypassed. Publicly available exploit code exists (full PoC published in the vendor GHSA advisory); there is no public evidence of active exploitation.
RemediationAI
Vendor-released patch: upgrade Incus to 7.2.0 or later, which re-enforces the lowlevel restriction across the snapshot restore/import path; this is the primary and recommended fix (see https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv). Until you can patch, reduce exposure by restricting who can create and especially move/import instances and snapshots into restricted projects - limit move/migration permissions to trusted administrators, since the attack hinges on transferring an externally crafted instance+snapshot into the protected project. As an additional compensating control, scrutinize or block cross-project and cross-server instance moves into projects that rely on restricted.containers.lowlevel=block, and audit existing snapshots for raw.lxc/raw.qemu hook content before restoring them; the trade-off is reduced migration flexibility and added operational overhead. Note that setting restricted.containers.lowlevel=block alone does NOT mitigate this issue on unpatched versions, which is the core of the bug.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Incus is a system container and virtual-machine manager (a community fork of Canonical's LXD), written in Go; the affected component is the incusd daemon (pkg:go/github.com/lxc/incus/v7/cmd/incusd). Incus exposes 'low-level' passthrough configuration keys - raw.lxc and raw.qemu - that inject raw directives into the underlying LXC/QEMU runtime, including lifecycle hooks such as lxc.hook.pre-start that run on the host. To contain this power, projects can set restricted=true plus restricted.containers.lowlevel=block to forbid these keys. The root cause is CWE-862 (Missing Authorization): the snapshot restore/import code path does not validate restored low-level configuration against the destination project's restrictions, so a value blocked at config-set time is accepted when it arrives embedded inside a snapshot. Because hooks execute in the host context with root privileges, this is effectively a container-to-host escape gated only by the bypassed policy check.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable API with low-privilege project access (PR:L), low complexity; container-to-host escape changes scope (S:C) and yields root command execution, so C/I/A all High.
Primary rating from Vendor (https://github.com/lxc/incus).
CVSS VectorVendor: https://github.com/lxc/incus
DescriptionCVE.org
Summary
Instance snapshots ignore the restricted.containers.lowlevel=block setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as raw.lxc and raw.qemu.
Details
Instance snapshots ignore the restricted.containers.lowlevel=block setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as raw.lxc and raw.qemu.
As snapshots can be moved from one server to another, a malicious instance+snapshot can be crafted locally, moved to a restricted project and the snapshot restored for arbitrary command execution.
In practice, this allows a malicious actor to execute arbitrary commands on the host with root privileges.
PoC
# remote, restricted
incus project set rem:project restricted.true
incus project set rem:project restricted.containers.lowlevel=block
# locally, unrestricted project
incus init images:debian/trixie rce-raw-lxc
incus config set rce-raw-lxc raw.lxc='lxc.hook.pre-start = /bin/sh -c "/bin/id >/lxc-hook-prestart"'
incus snapshot create rce-raw-lxc snap0
#> allow transfer to restricted project
incus config unset rce-raw-lxc raw.lxc
# locally, transfer and trigger
incus move rce-raw-lxc rem: --mode push
incus snapshot restore rem:rce-raw-lxc snap0
incus start rem:rce-raw-lxcImpact
- Bypass of project restrictions.
- Arbitrary command execution on the Incus server.
Executive ViewAI
Incus container platform versions before 7.2.0 contain a critical privilege escalation flaw that allows authenticated low-privileged users to gain root access to the host system by bypassing project isolation controls. Publicly available exploit code exists. Organizations using Incus for multi-tenant deployments or isolating untrusted workloads face immediate risk of complete infrastructure compromise. No vendor-released patch is currently available.
Restrict snapshot restore and project administration privileges to fully trusted personnel only; disable raw.lxc and raw.qemu configuration parameters; enforce strict role-based access control; maintain comprehensive audit logging of snapshot and project operations; implement network segmentation between Incus host systems and critical infrastructure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB