Debian dsa-6518 : golang-github-lxc-incus-dev - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6518 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6518-1 [email protected] https://www.debian.org/security/ Moritz...

CVE-2026-63343

A flaw was found in Incus, a system container and virtual machine manager. An authenticated Incus user can exploit this vulnerability by providing a malicious image containing a metadata.yaml symlink that points to an arbitrary host path. This allows the user to read or overwrite any file on the...

The vulnerability of the `createDependentVolumesFromBackup()` function in the `internal/server/storage/backend.go` file of the container management system and the virtual machine manager Incus allows a attacker to trigger a service failure.

The vulnerability of the createDependentVolumesFromBackup function in the internal/server/storage/backend.go file of the container management system and the virtual machine manager Incus is related to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to trigg...

ROS-20260921-73-0070

The vulnerability in the incus is related to deficiencies in the authentication mechanism. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

ROS-20260921-73-0069

The vulnerability in the incus is related to the incorrect definition of the link before accessing the file. Exploiting this vulnerability can allow an attacker to enhance their privileges...

The vulnerability of the instancesPost() function in the cmd/incusd/instances_post.go file of the container management system and the Incus virtual machine manager, which allows a attacker to disclose protected information

The vulnerability of the instancesPost function in the cmd/incusd/instancespost.go file of the container management system and the Incus virtual machine manager is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

ROS-20260921-73-0074

The vulnerability in the incus is related to deficiencies in the authentication mechanism. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

ROS-20260921-73-0073

The vulnerability in the incus is related to the insertion or modification of arguments. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

ROS-20260921-73-0072

The vulnerability in the incus is related to deficiencies in the authorization process. Exploiting this vulnerability could allow a remote attacker to gain unauthorized access to protected information...

ROS-20260921-73-0067

The vulnerability in the incus is related to incorrect external management of the name or file. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the `storagePoolVolumesPost()` function in the `cmd/incusd/storage_volumes.go` file of the container management system and the Incus virtual machine manager, which allows a attacker to disclose protected information.

The vulnerability of the storagePoolVolumesPost function in the cmd/incusd/storagevolumes.go file of the container management system and the Incus virtual machine manager is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to disclose sensitive...

The vulnerability of the uploadDir() function in the internal/server/storage/s3/local/multipart.go file of the container management system and the virtual machine manager software from Incus, which allows a attacker to execute arbitrary commands.

The vulnerability of the uploadDir function in the internal/server/storage/s3/local/multipart.go file of the container management system and the virtual machine manager Incus is related to improper external manipulation of the file name or path. Exploiting this vulnerability allows a remote...

GO-2026-6319 Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus

Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus...

GO-2026-6318 Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus

Incus has a project restriction bypass for custom volume copy across projects in github.com/lxc/incus...

incus-7.4-1.1 on GA media (moderate)

incus-7.4-1.1 on GA media Announcement ID: openSUSE-SU-2026:11651-1 Rating: moderate Cross-References: CVE-2026-39402 CVE-2026-47753 CVE-2026-48749 CVE-2026-48750 CVE-2026-48751 CVE-2026-48752 CVE-2026-48753 CVE-2026-48754 CVE-2026-48755 CVE-2026-48756 CVE-2026-48769 CVE-2026-55621 CVE-2026-55622...

ROS-20260901-73-0030

The vulnerability in the incus is related to incorrect external management of the name or file. Exploiting this vulnerability can allow an attacker to increase their privileges...

ROS-20260901-73-0027

The vulnerability in the incus is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service failures...

ROS-20260901-73-0029

The vulnerability in the incus is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service failures...

ROS-20260901-73-0031

The vulnerability in the incus is related to deficiencies in the authorization process. Exploiting this vulnerability could allow a remote attacker to gain unauthorized access to protected information...

ROS-20260901-73-0033

The vulnerability in the incus is related to incorrect external management of the name or file. Exploiting this vulnerability can allow an attacker to increase their privileges...