CVE-2026-48750

Executive Summary

CVE-2026-48750 is a critical (CVSS 9.9) path traversal-style flaw in Incus, a system container and virtual machine manager with a Linux daemon-style architecture. Prior to version 7.2.0, the record-output parameter of the /instances/$name/exec endpoint allows the exec-output directory of an instance to be replaced with a symlink, enabling writes to arbitrary filesystem locations outside the container via the exec_UUID.stdout and exec_UUID.stderr files. A successful attack allows a low-privileged user with API access to achieve arbitrary command execution on the host, with a CVSS scope change indicating the compromise extends beyond the original authorization boundary to the underlying infrastructure. No in-the-wild exploitation has been reported via CISA KEV as of this writing, and the exploitation status remains unknown.

Technical Analysis

The vulnerability resides in the command execution endpoint of the Incus instance management API. The endpoint /instances/$name/exec is designed to execute commands inside a container or virtual machine instance and optionally record their terminal output. When the record-output parameter is enabled, Incus writes the captured standard output and standard error streams to two files — exec_UUID.stdout and exec_UUID.stderr — located in an instance-specific exec-output directory.

The flaw arises from insufficient handling of filesystem semantics when resolving the exec-output path. Specifically, if an attacker — who has administrative rights over a single instance (achievable via low-privileged API access) — replaces the instance's exec-output directory with a symlink pointing to an arbitrary host filesystem location, the daemon will follow that symlink when writing the output files. Because the file names include a UUID, they are somewhat unpredictable, but the attacker controls the command execution itself, meaning the .stdout file content is fully attacker-controlled. This combination — controlled file path (via symlink) and controlled file content (via command output) — provides a primitive that can be abused for arbitrary file write followed by arbitrary command execution, likely through techniques such as writing to /etc/cron.d/ or ~/.ssh/authorized_keys depending on the daemon's privileges.

The root cause maps to CWE-73 (External Control of File Name or Path), which is a classic path traversal / insecure directory permission flaw. The vulnerability is remotely exploitable over the network with low attack complexity and requires low privileges (PR:L) — specifically a valid API session that can create or manage an instance. No user interaction is needed, and the scope (S:C) means a compromised instance can impact resources beyond the instance context — in this case, the host operating system running the Incus daemon.

The confidentiality, integrity, and availability impacts are all rated HIGH, reflecting that this flaw can lead to full host compromise — reading arbitrary host files, writing/overwriting arbitrary files, and disrupting the host service or the entire system.

The patch, available in version 7.2.0, addresses the symlink-following behavior — either by refusing to write through symlinks, by validating that the resolved path remains within the intended instance directory, or by removing the directory traversal primitive entirely.

Exploitation Scenarios

No public PoC or exploit code is known to exist for this CVE at the time of writing. The following attack chain is inferred strictly from the vulnerability class described in the NVD entry (CWE-73 — External Control of File Name or Path) and the mechanism explicitly described.

Step 1 — Reconnaissance and Target Identification: An attacker with network access to an Incus API endpoint identifies a target running a version prior to 7.2.0. Because the vulnerability requires low privileges (PR:L), the attacker must first obtain valid credentials or an API token for an account that can create or manage at least one instance. In typical deployments, the Incus API is exposed on a management interface, often on a dedicated network or via TCP port 8443 for the client API. Shodan-style search for "incus" or related service banners could identify exposed systems exposed to the Internet.

Step 2 — Triggering the Vulnerability: Once authenticated, the attacker creates a new instance or uses an existing container over which they have administrative control. The attacker replaces the instance's exec-output directory with a symlink pointing to an arbitrary host path, such as /etc/cron.d/ or /root/.ssh/. This requires filesystem access within the instance, which is inherently available to the instance administrator. The attacker then invokes the /instances/$name/exec endpoint with the record-output parameter enabled, executing a command whose output will be captured.

Step 3 — Payload Execution: Because the exec-output path is resolved through the symlink, the daemon writes exec_UUID.stdout and exec_UUID.stderr to the attacker-chosen target directory. The attacker controls the command executed, so the contents of the .stdout file are fully attacker-controlled. For persistence, the attacker could execute a command that emits a cron job configuration (e.g., a line invoking a reverse shell), causing the daemon to write that content to /etc/cron.d/. Alternatively, the attacker could target /root/.ssh/authorized_keys to inject an SSH public key, or overwrite a systemd unit file to achieve code execution on the next boot.

Step 4 — Post-Exploitation Impact: Once arbitrary file write is achieved, the attacker transitions to host-level arbitrary code execution. Depending on the privileges of the Incus daemon process (typically root), this yields full host compromise. The attacker can then pivot laterally across the network, exfiltrate sensitive data from the host and other containers/VMs, install persistence mechanisms, or use the compromised host as a stepping stone for further network intrusions.

This attack chain relies on the combination of an instance-level privilege — which is intended isolation — and the daemon's failure to properly resolve symlinks, which breaks the security boundary between the instance and the host.

Impact Assessment

CVE-2026-48750 carries a CVSS base score of 9.9 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. This is a critical-severity vulnerability with the following implications:

• Access Vector (AV:N): The vulnerability is exploitable remotely over the network, requiring no physical presence or local access.
• Attack Complexity (AC:L): No special conditions, race conditions, or user interaction are required. The attack is straightforward once a low-privileged account is obtained.
• Privileges Required (PR:L): Only low-level privileges are needed — a valid account that can manage at least one instance. In multi-tenant deployments, this means any tenant can attack the host.
• User Interaction (UI:N): No victim action is required; the attack is fully automated once the API session is established.
• Scope (S:C): The vulnerability breaks the container/VM isolation boundary — a compromised instance compromises the host and, by extension, all other instances on that host. This constitutes a complete trust boundary violation.
• Confidentiality/Integrity/Availability (all C:H/I:H/A:H): An attacker can read arbitrary host files, write arbitrary content to arbitrary files, and cause a denial of service on the host.

Affected Systems: All Incus installations running version prior to 7.2.0 are vulnerable. This includes any deployment exposing the Incus API to untrusted users — particularly multi-tenant environments where instance creation is self-service. Because the exploit requires only low privileges, the blast radius is significant: in a container-as-a-service setup, every tenant becomes a potential host compromise vector.

Business Impact: Organizations running Incus in production face risks of complete infrastructure compromise if the API is reachable by any unauthenticated party that can obtain low-level credentials. The vulnerability undermines the entire trust model of container isolation, which is the foundational security property for multi-tenant infrastructure.

Detection Guidance

The following detection rules target the exploitation patterns associated with CVE-2026-48750: anomalous API calls to the exec endpoint with record-output enabled, file writes to sensitive host directories, and the creation of symlinks within instance metadata directories.

Sigma Rule

title: Incus Exec Output Symlink - Suspicious File Write
id: a3f4d1e2-8b7c-4e5f-9a1d-2c3b4a5d6e7f
status: experimental
description: Detects potential exploitation of CVE-2026-48750 via exec-output symlink abuse
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-48750
tags:
  - attack.t1190
  - attack.initial-access
logsource:
  category: process_creation
  product: linux
detection:
  selection_incus:
    Image|endswith:
      - '/incusd'
      - '/incus'
    CommandLine|contains:
      - 'exec-output'
      - 'record-output'
  selection_symlink:
    CommandLine|contains:
      - 'ln -s'
      - 'symlink'
  selection_sensitive_path:
    CommandLine|contains:
      - '/etc/cron.d/'
      - '/root/.ssh/'
      - '/etc/systemd/system/'
  condition: selection_incus and (selection_symlink or selection_sensitive_path)
  timeframe: 10m
level: critical
falsepositives:
  - Legitimate administrative automation that uses output recording
  - Administrator-created symlinks for monitoring
fields:
  - ParentImage
  - User
  - CommandLine

YARA Rule

rule incus_exec_output_symlink_abuse {
    meta:
        author = "VMSI Threat Intel"
        description = "Detects config files or scripts referencing Incus exec-output symlink paths"
        date = "2026-01-01"
        reference = "CVE-2026-48750"
        severity = "critical"
    strings:
        $exec_endpoint = "/instances/"
        $record_output = "record-output"
        $exec_output = "exec-output"
        $stdout_file = "exec_" ascii
        $stdout_ext = ".stdout" ascii
        $stderr_ext = ".stderr" ascii
        $symlink_cmd = "symlink" ascii nocase
        $ssh_keys = "authorized_keys" ascii nocase
        $cron = "cron.d" ascii nocase
    condition:
        uint16(0) == 0x0A23 or uint16(0) == 0x0A21 or filesize < 500KB and
        (1 of ($exec_endpoint, $record_output, $exec_output)) and
        (1 of ($stdout_file, $stdout_ext, $stderr_ext)) and
        (1 of ($symlink_cmd, $ssh_keys, $cron))
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-48750 Incus Exec Output Record Attempt";
    flow:to_server,established;
    http.method:"POST";
    http.uri:contains"exec";
    http.uri:contains"/instances/";
    http.request_body:contains"record-output";
    content:"record-output"; http_server_body; within:500;
    sid:202648750;
    rev:1;
    metadata:attack_target_server, deployment_perimeter, cve2026_48750, signature_severity_critical;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2026-48750;
    classtype:attempted-admin;
)

Elastic Detection

// Elastic EQL query to identify Incus exec-output symlink exploitation patterns
sequence by host.name
    [process where event.type == "start" and
        process.name == "ln" and
        process.args : ("-s", "--symbolic") and
        process.args : "*exec-output*"
    ] by process.entity_id
    [file where event.type == "creation" and
        file.path : ("/etc/cron.d/*", "/root/.ssh/*", "/etc/systemd/system/*")
    ] by process.parent.entity_id
    [process where event.type == "start" and
        process.name : ("incusd", "incus")
    ] by process.parent.entity_id

Splunk SPL Query

index=linux sourcetype=linux_audit OR sourcetype=bash
    (symlink OR ln_command)
    AND (
        (process.executable=*ln* AND process.args=*-s* AND process.args=*exec-output*)
        OR process.args=*record-output*
    )
| eval vulnerable = if(process.args LIKE "%/etc/cron.d/%" OR process.args LIKE "%/root/.ssh/%" OR process.args LIKE "%/etc/systemd/system/%", "HIGH_SUSPICION", "MONITOR")
| where vulnerable == "HIGH_SUSPICION"
| eval cve = "CVE-2026-48750"
| table _time, host, user, process.executable, process.args, vulnerable, cve

Wazuh OSSEC Rule

<group name="incus,">
  <rule id="100487" level="15" frequency="5" timeframe="60">
    <if_sid>100000</if_sid>
    <match>exec-output</match>
    <description>Incus: Possible CVE-2026-48750 exploitation attempts detected — exec-output symlink usage</description>
    <mitre>
      <tactic id="TA0001" name="Initial Access"/>
      <technique id="T1190" name="Exploit Public-Facing Application"/>
    </mitre>
    <group>incus_cve_2026_48750</group>
  </rule>
  <rule id="100488" level="15" frequency="10" timeframe="300">
    <if_sid>100487</if_sid>
    <regex>(\/etc\/cron\.d\/|\/root\/\.ssh\/|\/etc\/systemd\/system\/)</regex>
    <description>Incus: HIGH confidence CVE-2026-48750 — write attempt to sensitive directory</description>
    <group>incus_cve_2026_48750</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 — LIKELY — The fix is confirmed by 2 independent sources (Debian and upstream Incus 7.2.0 release). Apply the patch immediately.

Immediate Mitigations (if patching is not immediately possible):

1. Restrict API access: Disable any public or 0.0.0.0 binding of the Incus API. If remote access is required, restrict the management endpoint to trusted internal networks only via firewall rules — never expose it to the Internet.
2. Enforce strong authentication / MFA: Reduce the attack surface by requiring multi-factor authentication for all Incus API accounts, especially low-privileged ones. An attacker cannot exploit this flaw without a valid account.
3. Review existing instance metadata: Manually inspect all instances for suspicious exec-output symlinks. Remove and disable record-output functionality if it is not business-critical. Add discretionary access control (DAC) restrictions on the exec-output directory to prevent symlink creation by instance users.
4. Monitor aggressively: Enable the detection rules above, particularly watching for writes to /etc/cron.d, /root/.ssh, and /etc/systemd/system from the Incus daemon process.
5. Least privilege: Run the Incus daemon with reduced privileges if the deployment architecture permits (e.g., without root capabilities) to limit the impact of a successful exploit.

Patch/Upgrade Steps:

1. Upgrade to Incus version 7.2.0 or later — this is the only complete fix. For Debian-based systems, pull the updated package from the Debian repositories:

   sudo apt update
   sudo apt install incus
   

2. Verify the version after upgrade:

   incus admin version
   

3. Restart the daemon and verify that all instances and configuration are restored correctly.

Long-Term Hardening:

• Implement a regular patch management cadence to ensure Incus remains up-to-date.
• Use a dedicated security account with minimal privileges for API access; tightly manage API token lifecycle (rotation, revocation).
• Deploy network segmentation so that the management API is only reachable from dedicated administration networks.
• Enable auditd or equivalent host-level auditing that captures file creation, symlink events, and process execution from the Incus daemon.
• Consider running Incus inside a hardened OS with SELinux or AppArmor confinement applied to the daemon process to limit filesystem writes outside the expected data directories.
• Conduct periodic security reviews of all multi-tenant infrastructure to ensure isolation boundaries are robust against similar path-handling flaws.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-48750 — Official CVE details, CVSS vector, and NVD description.
2. Incus Official Repository / Release Notes — Version 7.2.0 changelog confirming the patch addressing the exec-output symlink behavior. (Refer to the project's GitHub release page.)
3. Debian Security Tracker — Confirmation of the patched version in Debian repositories (second independent source confirming the fix).
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Current status: NOT listed; no known in-the-wild exploitation as of this reporting period.
5. EPSS API / FIRST.org — Not yet scored; no EPSS data available as of this writing.

Threat Actor Activity: No known threat actor campaigns or exploit-in-the-wild evidence for CVE-2026-48750 has been observed at the time of publication. The vulnerability is critical and carries high exploitation potential; security teams should treat this as a high-priority patch regardless of the absence of active exploitation reports.