Incus
Monthly
Arbitrary file write in Incus (before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0) allows an authenticated client permitted to create instances or custom volumes, or a malicious migration source server, to plant symlinks such as rootfs pointing at / in an incoming volume so rsync or btrfs receive writes attacker-controlled files as root on the target host, leading to full host compromise. All rsync-based storage drivers and the optimized btrfs path are affected, while optimized ZFS transfers are not; a symlink check added in 7.3 runs after the transfer and does not prevent the writes. The vuln.today priority is act_now, and no public exploit identified at time of analysis.
Project isolation bypass in Incus lets an authenticated client that is confined to one project copy and read custom storage volumes belonging to any other project on the same server, including volume snapshots and configuration. The flaw affects Incus 7.0.1 (fixed in 7.0.2) and 7.2.0 through 7.4.x (fixed in 7.5.0), and is reachable only through a hand-crafted POST to /1.0/storage-pools/{pool}/volumes/custom that supplies a source volume with an attacker-chosen source.project while omitting source.type - the official Incus client always sets source.type=copy and therefore cannot trigger it. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation requires legitimate low-privilege credentials holding can_create_storage_volumes in at least one project, so impact is concentrated on multi-project servers where project isolation is the actual security boundary.
Incus servers that use multi-project tenancy expose in-flight operations across project boundaries because the GET /1.0/operations/{uuid} handler performs no authorization check, letting any authenticated client - including one holding a TLS certificate restricted to a single project - read operations that belong to other projects. The disclosed data includes the full command line, the process environment (where deployment tooling typically stores database passwords, API tokens and cloud credentials), the operation's websocket fd secrets and resource URLs, and, when an 'incus config trust add' operation happens to be pending, the trust-enrolment token itself, which the reporter demonstrated could be exchanged for an unrestricted certificate and full server admin. Exploitation is constrained: the attacker must already hold a project-restricted certificate and must obtain the 122-bit crypto/rand UUIDv4 of a specific in-flight operation out of band, since Incus discloses no enumeration path to a restricted client. The issue carries no CISA KEV entry or reported active exploitation; the upstream advisory includes a step-by-step reproduction sequence, which is the only published proof of concept.
Authenticated restricted TLS clients on Incus can retrieve S3 access and secret keys for storage buckets in the default project, enabling them to read, modify, or delete bucket objects directly through the S3 endpoint. The issue affects Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 when the TLS authorizer is in use; OpenFGA deployments are not affected. No public exploit identified at time of analysis.
Path traversal in Incus system container manager allows authenticated remote attackers to write arbitrary files as root on the host via malformed systemd credential configuration keys. Affecting all versions before 6.23.0, this enables both privilege escalation from container to host and denial of service through critical file overwrites. EPSS score of 0.06% (18th percentile) indicates low observed exploitation probability, with no public exploit identified at time of analysis. The CVSS 9.9 Critical rating reflects the severe impact of container escape, though the PR:L requirement and lack of active exploitation temper immediate urgency.
Authentication bypass in Incus webui (versions prior to 6.23.0) permits local or remote attackers to gain unauthorized access to the system container and virtual machine manager via an improperly validated authentication token. The vulnerability allows attackers who can reach the temporary localhost web server to escalate privileges to the level of the user running 'incus webui', enabling control over containers, virtual machines, and potentially underlying system resources. CVSS score of 8.8 (High) reflects network attack vector with low complexity requiring user interaction; no public exploit identified at time of analysis.
Incus system container and virtual machine manager versions prior to 6.23.0 allow authenticated users with instance access to read and write arbitrary files as root on the host system through exploitation of pongo2 template processing. The vulnerability (scored CVSS 10.0 critical) stems from a bypassed chroot isolation mechanism that was intended to confine template operations to instance filesystems but instead permits unrestricted host filesystem access. No public exploit identified at time of analysis, though the vulnerability is tagged as Server-Side Template Injection (SSTI) with a GitHub security advisory published.
Incus is a system container and virtual machine manager. [CVSS 8.7 HIGH]
Incus contains a vulnerability that allows attackers to adding arbitrary lifecycle hooks, ultimately resulting in arbitrary command exec (CVSS 8.7).
Denial of service in Incus prior to version 6.23.0 allows authenticated users with storage bucket access to crash the Incus daemon via specially crafted storage bucket backups, enabling repeated attacks to render the control plane API unavailable while leaving running workloads unaffected. The vulnerability requires local or remote authentication to the Incus system and has a CVSS score of 6.5 (medium severity) with high availability impact. Vendor-released patch available in version 6.23.0.
Incus versions prior to 6.23.0 allow local authenticated attackers to manipulate temporary screenshot files via predictable /tmp paths and symlink attacks, potentially truncating and altering permissions of arbitrary files on systems with disabled symlink protection (rare), leading to denial of service or local privilege escalation. The vulnerability requires local access and authenticated user privileges but is particularly dangerous on systems without kernel-level symlink protections enabled. An exploit proof-of-concept exists, and the vendor has released patched version 6.23.0 to address the issue.
Incus versions prior to 6.23.0 fail to validate image fingerprints when downloading from simplestreams servers, enabling attackers with local privileges to poison the image cache and potentially cause other tenants to execute attacker-controlled container or virtual machine images instead of legitimate ones. The vulnerability requires local authentication and specific conditions but carries high integrity impact in multi-tenant environments; no active exploitation has been confirmed.
Incus is a system container and virtual machine manager. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Arbitrary file write in Incus (before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0) allows an authenticated client permitted to create instances or custom volumes, or a malicious migration source server, to plant symlinks such as rootfs pointing at / in an incoming volume so rsync or btrfs receive writes attacker-controlled files as root on the target host, leading to full host compromise. All rsync-based storage drivers and the optimized btrfs path are affected, while optimized ZFS transfers are not; a symlink check added in 7.3 runs after the transfer and does not prevent the writes. The vuln.today priority is act_now, and no public exploit identified at time of analysis.
Project isolation bypass in Incus lets an authenticated client that is confined to one project copy and read custom storage volumes belonging to any other project on the same server, including volume snapshots and configuration. The flaw affects Incus 7.0.1 (fixed in 7.0.2) and 7.2.0 through 7.4.x (fixed in 7.5.0), and is reachable only through a hand-crafted POST to /1.0/storage-pools/{pool}/volumes/custom that supplies a source volume with an attacker-chosen source.project while omitting source.type - the official Incus client always sets source.type=copy and therefore cannot trigger it. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation requires legitimate low-privilege credentials holding can_create_storage_volumes in at least one project, so impact is concentrated on multi-project servers where project isolation is the actual security boundary.
Incus servers that use multi-project tenancy expose in-flight operations across project boundaries because the GET /1.0/operations/{uuid} handler performs no authorization check, letting any authenticated client - including one holding a TLS certificate restricted to a single project - read operations that belong to other projects. The disclosed data includes the full command line, the process environment (where deployment tooling typically stores database passwords, API tokens and cloud credentials), the operation's websocket fd secrets and resource URLs, and, when an 'incus config trust add' operation happens to be pending, the trust-enrolment token itself, which the reporter demonstrated could be exchanged for an unrestricted certificate and full server admin. Exploitation is constrained: the attacker must already hold a project-restricted certificate and must obtain the 122-bit crypto/rand UUIDv4 of a specific in-flight operation out of band, since Incus discloses no enumeration path to a restricted client. The issue carries no CISA KEV entry or reported active exploitation; the upstream advisory includes a step-by-step reproduction sequence, which is the only published proof of concept.
Authenticated restricted TLS clients on Incus can retrieve S3 access and secret keys for storage buckets in the default project, enabling them to read, modify, or delete bucket objects directly through the S3 endpoint. The issue affects Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 when the TLS authorizer is in use; OpenFGA deployments are not affected. No public exploit identified at time of analysis.
Path traversal in Incus system container manager allows authenticated remote attackers to write arbitrary files as root on the host via malformed systemd credential configuration keys. Affecting all versions before 6.23.0, this enables both privilege escalation from container to host and denial of service through critical file overwrites. EPSS score of 0.06% (18th percentile) indicates low observed exploitation probability, with no public exploit identified at time of analysis. The CVSS 9.9 Critical rating reflects the severe impact of container escape, though the PR:L requirement and lack of active exploitation temper immediate urgency.
Authentication bypass in Incus webui (versions prior to 6.23.0) permits local or remote attackers to gain unauthorized access to the system container and virtual machine manager via an improperly validated authentication token. The vulnerability allows attackers who can reach the temporary localhost web server to escalate privileges to the level of the user running 'incus webui', enabling control over containers, virtual machines, and potentially underlying system resources. CVSS score of 8.8 (High) reflects network attack vector with low complexity requiring user interaction; no public exploit identified at time of analysis.
Incus system container and virtual machine manager versions prior to 6.23.0 allow authenticated users with instance access to read and write arbitrary files as root on the host system through exploitation of pongo2 template processing. The vulnerability (scored CVSS 10.0 critical) stems from a bypassed chroot isolation mechanism that was intended to confine template operations to instance filesystems but instead permits unrestricted host filesystem access. No public exploit identified at time of analysis, though the vulnerability is tagged as Server-Side Template Injection (SSTI) with a GitHub security advisory published.
Incus is a system container and virtual machine manager. [CVSS 8.7 HIGH]
Incus contains a vulnerability that allows attackers to adding arbitrary lifecycle hooks, ultimately resulting in arbitrary command exec (CVSS 8.7).
Denial of service in Incus prior to version 6.23.0 allows authenticated users with storage bucket access to crash the Incus daemon via specially crafted storage bucket backups, enabling repeated attacks to render the control plane API unavailable while leaving running workloads unaffected. The vulnerability requires local or remote authentication to the Incus system and has a CVSS score of 6.5 (medium severity) with high availability impact. Vendor-released patch available in version 6.23.0.
Incus versions prior to 6.23.0 allow local authenticated attackers to manipulate temporary screenshot files via predictable /tmp paths and symlink attacks, potentially truncating and altering permissions of arbitrary files on systems with disabled symlink protection (rare), leading to denial of service or local privilege escalation. The vulnerability requires local access and authenticated user privileges but is particularly dangerous on systems without kernel-level symlink protections enabled. An exploit proof-of-concept exists, and the vendor has released patched version 6.23.0 to address the issue.
Incus versions prior to 6.23.0 fail to validate image fingerprints when downloading from simplestreams servers, enabling attackers with local privileges to poison the image cache and potentially cause other tenants to execute attacker-controlled container or virtual machine images instead of legitimate ones. The vulnerability requires local authentication and specific conditions but carries high integrity impact in multi-tenant environments; no active exploitation has been confirmed.
Incus is a system container and virtual machine manager. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.