EUVD-2026-63989Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Authenticated low-priv user (PR:L) reaches the network daemon (AV:N/AC:L); CWE-73 path control on a privileged host daemon justifies scope change and high CIA, though disclosure-only impact is plausible.
Primary rating from Vendor (vendor:alpine).
CVSS VectorVendor: vendor:alpine
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
Alpine Linux: incus-feature fixed in 7.3.0-r0
AnalysisAI
Privilege escalation and information disclosure in the Incus container and VM manager (Alpine Linux package incus-feature, fixed in 7.3.0-r0) lets a low-privileged but authenticated user abuse attacker-controlled file names/paths (CWE-73) to reach data or resources outside their intended boundary, with a scope-changed impact reaching the host. The CVSS 9.9 rating reflects network reachability, low attack complexity, and full compromise of confidentiality, integrity, and availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be an authenticated Incus user with at least low privileges (CVSS PR:L) and network reachability to the Incus daemon's API (AV:N); no user interaction is needed (UI:N) and attack complexity is low (AC:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 9.9) indicates a network-reachable, low-complexity flaw requiring only low privileges, no user interaction, and a scope change yielding full CIA impact - a strong prioritization signal. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a low-privilege Incus account (for example a restricted project user or delegated API certificate) crafts a request containing an attacker-controlled file name or path parameter, causing the privileged Incus daemon to reference a host location outside the caller's intended scope and disclose or tamper with sensitive host/instance data. Because the CVSS scope is changed (S:C) with full CIA impact, a successful action can extend beyond the user's project to the host. … |
| Remediation | Vendor-released patch: upgrade the Alpine incus-feature package to 7.3.0-r0 or later (run 'apk update && apk upgrade incus-feature', or a full 'apk upgrade', on affected Alpine hosts). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all systems running incus-feature on Alpine Linux and assess the authentication exposure within your environment, documenting which users have access to affected Incus instances. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today