PT-2026-84368

These are all security issues fixed in the incus-7.4-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-84367

These are all security issues fixed in the incus-7.4-1.1 package on the GA media of openSUSE Tumbleweed...

EUVD-2026-63985

Incus has a project restriction bypass in instance copy across projects...

GHSA-C9F5-J9C3-MHRG Incus has a project restriction bypass in instance copy across projects

Summary Missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new project. This issue could allow an attacker to access secrets in instances they...

Incus has a project restriction bypass in instance copy across projects

Summary Missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new project. This issue could allow an attacker to access secrets in instances they...

GHSA-64F3-V33M-W89F Incus has a project restriction bypass for custom volume copy across projects

Summary Missing authorization checks exist for custom volume copying where an attacker who knows the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to access secrets i...

Incus has a project restriction bypass for custom volume copy across projects

Summary Missing authorization checks exist for custom volume copying where an attacker who knows the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to access secrets i...

EUVD-2026-63984

Incus has a project restriction bypass for custom volume copy across projects...

Linux Distros Unpatched Vulnerability : CVE-2026-81500

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Ubuntu Linux - Unknown description CVE-2026-81500 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenabl...

Linux Distros Unpatched Vulnerability : CVE-2026-81501

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Ubuntu Linux - Unknown description CVE-2026-81501 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenabl...

[BSA-138] Security Update for incus

Mathias Gibbens uploaded new packages for incus which fixed the following security problems: CVE ID : CVE-2026-62313 CVE-2026-62867 CVE-2026-62940 CVE-2026-62941 CVE-2026-63125 CVE-2026-63343 CVE-2026-81493 CVE-2026-81494 CVE-2026-81495 CVE-2026-81496 CVE-2026-81497 CVE-2026-81498 CVE-2026-81499...

CVE-2026-63125

A flaw was found in Incus, a container and virtual machine manager. A crafted container image can trick the daemon into writing to arbitrary host files via a symlink in backup.yaml, potentially leading to root-level command execution on the host. Mitigation No mitigation is needed as Incus is not...

CVE-2026-62941

A flaw was found in Incus, a container and virtual machine manager. A race condition when copying instances across projects allows dangerous configuration keys to bypass project restrictions, enabling privilege escalation and container escape. Mitigation No mitigation is needed as Incus is not...

CVE-2026-62940

A flaw was found in Incus, a container and virtual machine manager. During instance migration, security-critical configuration overrides bypass project restrictions, allowing a restricted user to escalate privileges and escape the container to the host. Mitigation No mitigation is needed as Incus...

CVE-2026-62867

A flaw was found in Incus, a container and virtual machine manager. Improper validation of storage volume settings allows a project-scoped user to inject arguments into commands executed as root on the host. Mitigation No mitigation is needed as Incus is not shipped in any Red Hat product...

CVE-2026-48769

A flaw was found in Incus, a container and virtual machine manager. A malicious image server can cause the Incus client to write files to arbitrary locations via a crafted response header, potentially leading to command execution as root. Mitigation No mitigation is needed as Incus is not shipped...

CVE-2026-48755

A flaw was found in Incus, a container and virtual machine manager. Improper validation of backup compression settings allows argument injection, leading to arbitrary file write on the host and potential command execution. Mitigation No mitigation is needed as Incus is not shipped in any Red Hat...

CVE-2026-48753

A flaw was found in Incus, a container and virtual machine manager. The S3 upload endpoint is vulnerable to path traversal, allowing creation of arbitrary files on the host, potentially leading to command execution. Mitigation No mitigation is needed as Incus is not shipped in any Red Hat product...

CVE-2026-48752

A flaw was found in Incus, a container and virtual machine manager. A crafted container image or backup can use a symlink in the templates directory to read or write arbitrary files on the host, potentially leading to command execution. Mitigation No mitigation is needed as Incus is not shipped i...

CVE-2026-48751

A flaw was found in Incus, a container and virtual machine manager. Instance snapshots do not enforce container restriction settings, allowing a user to execute arbitrary commands on the server through lowlevel hooks. Mitigation No mitigation is needed as Incus is not shipped in any Red Hat produ...