CVE-2026-62313

Incus (system container and VM manager) prior to 7.3.0 contains a bypass of the project-level restriction restricted.containers.privilege=isolated. The check only rejects an explicitly set security.idmap.isolated=false or empty value, but does not enforce the restriction when the key is omitted e...

EUVD-2026-63986

Incus is a system container and virtual machine manager. Prior to version 7.3.0, project-level enforcement of restricted.containers.privilege=isolated can be trivially bypassed, allowing a user to create a non-isolated shared host idmap container in a project that is configured to forbid them. Th...

CVE-2026-55622 Incus has a project restriction bypass in instance copy across projects

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new projec...

EUVD-2026-63985

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new projec...

CVE-2026-55622 Incus has a project restriction bypass in instance copy across projects

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new projec...

CVE-2026-55622

Incus , a system container and virtual machine manager, is affected by a missing authorization check in the instance copy operation across projects. An authenticated attacker who knows the name of an unauthorized project and an instance within it can copy that instance to a project they control, ...

CVE-2026-55621 Incus has a project restriction bypass for custom volume copy across projects

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume t...

CVE-2026-55621

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume t...

CVE-2026-55621

Incus , a system container and virtual machine manager, has a missing authorization check in its custom volume copy functionality prior to version 7.2.0 . An authenticated attacker who knows the name of a project they lack access to and a custom volume within that project can copy the volume to a...

CVE-2026-55621 Incus has a project restriction bypass for custom volume copy across projects

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume t...

CVE-2026-55621 Incus has a project restriction bypass for custom volume copy across projects

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume t...

EUVD-2026-63984

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume t...

CVE-2026-48769 Incus has an arbitrary file write on its client due to trusted image hash

Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches th...

CVE-2026-48769

CVE-2026-48769 is a critical (CVSS 9.9) arbitrary file write vulnerability in Incus , a system container and virtual machine manager, affecting versions prior to 7.2.0 . The root cause is that the Incus client trusts a crafted Incus-Image-Hash header returned by a malicious image server, leading ...

EUVD-2026-63983

Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches th...

CVE-2026-48769 Incus has an arbitrary file write on its client due to trusted image hash

Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches th...

EUVD-2026-63982

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command...

CVE-2026-48755 Incus has an argument injection in backup compression algorithm leading to AFW and ACE

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command...

CVE-2026-48755

Incus , a system container and virtual machine manager, is affected by an argument injection vulnerability in its backup functionality. Prior to version 7.1.0 , improper validation of the user-provided backup compression algorithm allows injection into the constructed command line, leading to arb...

CVE-2026-48755

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command...