CVE-2026-47753

Executive Summary

CVE-2026-47753 is a nil-pointer dereference vulnerability in Incus, a system container and virtual machine manager, affecting all versions prior to 7.1.0. An authenticated user with permission to create instances in any project can trigger a remote denial-of-service (DoS) condition by uploading a crafted backup tarball, causing the Incus daemon to panic and crash, thereby disrupting every project on that cluster member. The flaw resides in (*backend).CreateInstanceFromBackup within internal/server/storage/backend.go, where a missed Volume field check on the instance-import path leads to the crash. Version 7.1.0 contains the complete patch.

Technical Analysis

Incus manages system containers and virtual machines, with internal backup/restore functionality for instance portability. The backup import path is a critical attack surface because it accepts user-controlled tarball input that is parsed and processed by multiple components.

The vulnerability is a classic CWE-476 (NULL Pointer Dereference). The code path in question is (*backend).CreateInstanceFromBackup located in internal/server/storage/backend.go. This function is responsible for creating an instance from a backup archive, parsing the embedded backup/config.Config structure to determine instance properties, storage volume configurations, and other metadata.

Prior to version 7.1.0, the patch set for three sibling advisories — GHSA-fwj8-62r8-8p8m, GHSA-r7w7-mmxr-47r9, and GHSA-x5r6-jr56-89pv (all assigned 2026-05-04) — added nil-checks on adjacent fields of the backup/config.Config struct. However, the Volume field on the instance-import path was omitted from those patches. When a crafted backup tarball is uploaded containing a config.Config structure where the Volume field is absent, null, or malformed, the CreateInstanceFromBackup function dereferences the nil pointer during processing, leading to a Go runtime panic.

In Go, an unrecovered panic in a goroutine causes the entire process to terminate. Since Incus runs as a monolithic daemon handling all projects on a cluster member, this crash results in a complete denial of service for all projects on that member, not just the project from which the malicious upload originated. The crash is remote-triggerable because the backup upload is performed over the Incus REST API.

The attack requires authentication — specifically "permission to create instances in any project" — but notably does not require administrative privileges. This broadens the attack surface, as any user with instance-creation rights (e.g., a tenant in a multi-project deployment, or a lower-privileged operator) can crash the daemon.

Insufficient technical detail is available in the NVD description regarding the exact structure of the malicious tarball or the precise code flow after the nil dereference; however, the vulnerability class and attack mechanism are well understood from the description.

Exploitation Scenarios

1) Reconnaissance / Target Identification — An attacker first identifies an Incus deployment. This can be done via Shodan searches for Incus API endpoints, or by network discovery of the default Incus port (8443 for the REST API, though the exact port is not specified in the NVD description and should not be assumed — instead, discovery focuses on identifying any machine exposing an Incus management interface). The attacker also needs valid credentials for an account with "create instance" permission in at least one project.

2) Triggering the Flaw Class — The attacker crafts a malicious backup tarball. Since the vulnerability is a nil-pointer dereference on the Volume field of the backup/config.Config struct during the instance-import path, the tarball must contain a config.yaml (or equivalent internal config file — exact filename not specified in the description) that omits or nullifies the Volume entry while otherwise appearing as a legitimate backup. The attacker then uploads this tarball via the Incus API's backup-import endpoint.

3) Payload / Execution Method at Vulnerability-Class Level — This is not a code-execution vulnerability; the "payload" is purely a malformed configuration within the backup archive. When the Incus daemon parses the backup and calls (*backend).CreateInstanceFromBackup, the missing Volume field results in a nil pointer dereference. The Go runtime detects the nil pointer, raises a panic, and — because the panic is unrecovered — terminates the entire Incus daemon process.

4) Post-Exploitation Impact — The daemon crash causes an immediate denial of service affecting every project on that cluster member. All running containers and VMs managed by that member become unavailable, and no new instances can be created. In a clustered deployment, the impact may be partially mitigated if other cluster members can take over workloads (depending on Incus clustering configuration), but the affected member itself is fully incapacitated until the daemon is restarted by an operator. Since the attack is repeatable, an attacker can re-crash the daemon at will, creating a persistent DoS condition. No data corruption or code execution is indicated by the vulnerability description.

No public PoC is available at the time of writing; the attack chain is inferred from the vulnerability class and the NVD description.

Impact Assessment

• Confidentiality Impact: None — the vulnerability does not expose data.
• Integrity Impact: None — no data modification occurs.
• Availability Impact: High — the Incus daemon crashes, disrupting all projects and workloads on the cluster member. Recovery requires manual operator intervention to restart the daemon.
• Access Complexity: Low — requires only a valid account with instance-creation permission. No special privileges or race conditions needed.
• Attack Vector: Network (remote) — the crafted tarball is uploaded over the API.
• Attack Surface: Any Incus deployment exposing its API to authenticated users beyond the administrative owner. Multi-tenant deployments where multiple users have instance-creation rights are the highest-risk environments.
• Blast Radius: The entire cluster member, not just the targeted project. All containers and VMs on that member are impacted. In a cluster, the member becomes unavailable; if instances are not replicated to other members (common for non-replicated storage pools), workloads are completely lost until restart.

CVSS v3.1 score cannot be stated, as the official vector is N/A. Based on the criteria above, an estimated vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H would yield a score of 6.5 (Medium), but this is an estimate and the official CVSS score is not available.

Detection Guidance

Sigma Rule

title: Incus Backup Import - Crafted Tarball DoS Attempt
id: 3f8e2b4c-5d6a-4f9e-8c3b-1a2b3c4d5e6f
status: experimental
description: Detects backup import requests to Incus API from non-admin users that may contain malformed config structures triggering nil-pointer dereference
author: valtersit.com Threat Intel
date: 2026/05/12
logsource:
  category: application
  product: incus
  definition: 'Requires audit logging of Incus API requests. Enable via incus config set core.https_address and auditing.'
detection:
  selection:
    EventID: 'API_REQUEST'
    RequestMethod: 'POST'
    RequestURI|contains:
      - '/backups/import'
      - '/operations'
    UserAgent|contains: 'incus'
  filter_known_admin:
    ResponseCode: '200'
  condition: selection and not filter_known_admin
level: high
fields:
  - ClientIP
  - Username
  - RequestURI
  - RequestBodySize
falsepositives:
  - Legitimate backup migrations performed by operators

YARA Rule

rule Incus_CVE_2026_47753_Malicious_Backup
{
    meta:
        author = "valtersit.com Threat Intel"
        description = "Detects backup tarballs with missing Volume field in config.yaml, indicating CVE-2026-47753 exploitation attempt"
        cve = "CVE-2026-47753"
        date = "2026-05-12"
        severity = "high"
    strings:
        $config_marker = "config.yaml"
        $volume_key = "volume:"
        $projects_key = "project:"
        $nil_value = "volume: null"
    condition:
        // Backup archive must contain config.yaml
        $config_marker and $volume_key and not $nil_value
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Incus CVE-2026-47753 Backup Import DoS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/backups/import"; http_uri; content:"multipart/form-data"; http_header_names; content:"filename="; http_client_body; pcre:"/config\.yaml/"; reference:cve,2026-47753; classtype:attempted-dos; sid:2034775; rev:1;)

Elastic Detection

rule:
  - name: Incus Backup Import from Unusual Source
  query: |
    event.category: process AND
    process.name: incus AND
    process.args: (*import* OR *backup*) AND
    event.action: create AND
    source.ip: (not 127.0.0.1)

Splunk SPL Query

index=incus sourcetype=incus:api::access
| where match(uri, "^/backups/import") AND method=="POST"
| eval user_has_create_perm = if(project_role IN ("operator","admin"), "yes", "no")
| where user_has_create_perm=="yes" AND response_code != 200
| table _time, clientip, user, uri, response_code, body_bytes
| sort - _time

Wazuh OSSEC Rule

<group name="incus,">
  <rule id="100056" level="10">
    <decoded_as>json</decoded_as>
    <field name="process.name">incusd</field>
    <match>panic: runtime error: invalid memory address or nil pointer</match>
    <description>Incus daemon panic detected - possible CVE-2026-47753 exploitation</description>
    <group>incus,dos,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY) — Two independent sources (including Debian) confirm the fix in version 7.1.0.

Immediate Mitigations (before patching):

1. Restrict instance-creation permissions — Audit all users with create instance permission on any project. Remove this permission from users who do not strictly require it. Add a dedicated "backup-import operator" role if the deployment allows custom roles.
2. Disable external API access — If the Incus API is exposed beyond trusted internal networks, restrict access via firewall rules or reverse-proxy access lists. Require VPN access for administrative operations.
3. Monitor backup-import endpoints — Deploy the Sigma/Elastic/Splunk rules above to alert on unusual backup-import traffic.
4. Enable daemon auto-restart — Configure the Incus systemd unit with Restart=always and RestartSec=5 to minimize downtime windows after a crash, while accepting that this does not prevent the crash itself.

Patch/Upgrade Steps:

1. Upgrade to Incus 7.1.0 or later immediately. The updated patch covers the previously missed Volume field along with the three sibling advisories (GHSA-fwj8-62r8-8p8m, GHSA-r7w7-mmxr-47r9, GHSA-x5r6-jr56-89pv).
2. Follow the official upgrade procedure: back up all configuration and running instance metadata before upgrade, then perform a rolling upgrade across cluster members (one member at a time) to minimize downtime.
3. For Debian-based installations, monitor the Debian security tracker for the patched package version and apply via apt update && apt upgrade incus.

Long-Term Hardening:

1. Isolate multi-tenant workloads — Place high-risk tenants (users with instance-creation rights) on dedicated cluster members or projects with separate resource pools.
2. Adopt least-privilege RBAC — Review and restrict project roles; ensure only operators have instance-creation rights by default.
3. Regular security audits — Subscribe to Incus security announcements and GitHub advisory RSS feeds to catch future similar advisories (this is the fourth in a series — expect more adjacent-field nil-deref findings).
4. Harden storage-backend input validation — Encourage upstream to fuzz the backup-import parser; monitor for commits that add broader input validation rather than point patches to individual fields.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-47753
2. Debian Security Tracker (patch source — confirming fix in 7.1.0)
3. GitHub Advisory GHSA-fwj8-62r8-8p8m (sibling advisory — related nil-deref patch, 2026-05-04)
4. GitHub Advisory GHSA-r7w7-mmxr-47r9 (sibling advisory — related nil-deref patch, 2026-05-04)
5. GitHub Advisory GHSA-x5r6-jr56-89pv (sibling advisory — related nil-deref patch, 2026-05-04)

Threat Actor Activity: No known threat-actor campaigns or exploits-in-the-wild have been publicly documented as of this report's writing. CISA KEV does not list this CVE. The absence of a public PoC currently lowers the immediate exploitation likelihood, but the vulnerability is trivially triggerable given the low access prerequisites; enterprise SOCs should treat this as a priority-patch target regardless.