CVE-2026-48755

Executive Summary

CVE-2026-48755 is a high-severity improper input validation vulnerability (CWE-20) in Incus, a system container and virtual machine manager, affecting all versions prior to 7.1.0. The vulnerability stems from insufficient validation of user-supplied backup compression algorithm parameters, which permits argument injection into a constructed command line, ultimately leading to arbitrary file writes on the host operating system and potentially escalating to arbitrary command execution. With a CVSS score of 9.9 and a network attack vector requiring only low-privileged access and no user interaction, this flaw represents a critical risk for organizations running Incus instances in multi-tenant or internet-exposed configurations.

Technical Analysis

Vulnerability Mechanism

The vulnerability resides in the backup/restore functionality of Incus. When a user initiates a backup operation, Incus constructs a command line that invokes an external compression utility (e.g., tar, gzip, or similar) with a compression algorithm parameter derived from user input. The core flaw is that this user-provided parameter is not properly validated or sanitized before being interpolated into the command string.

Specifically, the NVD description states: "improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line." This indicates that the application builds a shell command in a manner that concatenates the user-supplied algorithm identifier directly into the command template, rather than using an allowlist or safe argument-passing mechanism (e.g., exec family with argument arrays instead of string concatenation).

Attack Surface

The attack surface for this vulnerability includes:

1. API Endpoints: Incus exposes a REST API (typically on TCP port 8443) for managing containers, VMs, and backups. Any authenticated user with permission to create or restore backups can trigger the vulnerable code path.

2. CLI Interface: The incus command-line client interacts with the API; however, the vulnerable logic likely lives server-side, meaning any authenticated API client (including compromised low-privileged accounts) can exploit this.

3. Multi-Tenancy: In environments where Incus is shared across teams or untrusted tenants (e.g., a hosting provider offering container/VPS services), a low-privileged user could exploit this to gain host-level access.

Codepath Analysis

Based on the vulnerability class (argument injection via improper input validation), the affected code likely follows this pattern:

1. The user submits a backup creation or restoration request (e.g., via POST /1.0/instances/{name}/backups) specifying a compression algorithm (e.g., gzip, bzip2, xz, or a custom value).

2. The server constructs a command such as:

   tar --use-compress-program=<user_input> -cf backup.tar /path/to/container
   

3. Because the <user_input> is not validated against an allowlist, an attacker can inject additional arguments. For example, providing gzip -c > /tmp/pwned as the algorithm could cause the shell to interpret the additional arguments, redirecting output or executing arbitrary commands.

Important note: The exact command template and injection point are not disclosed in the NVD description. The above is an illustrative pattern based on the vulnerability class and should not be treated as a confirmed implementation detail.

Root Cause

The root cause is the absence of:

• An allowlist for supported compression algorithms (e.g., only permitting gzip, bzip2, xz, zstd).
• Proper shell escaping or use of non-shell execution APIs (subprocess.run with argument lists in Python, or execvp-style calls in Go/C).

Exploitation Scenarios

Due to insufficient public technical detail, the exact exploitation flow is inferred from the vulnerability class. The following steps describe the likely attack chain:

Step 1 — Reconnaissance and Target Identification

The attacker first identifies an Incus server. This can be done via:

• Shodan/Censys searches for the Incus API port (8443) or the default web UI.
• Enumerating subdomains for container management panels.
• Checking for exposed/unauthenticated API endpoints (though authentication is typically required, low-privilege credentials may be obtained through phishing, credential stuffing, or prior compromise).

The attacker must have any valid account with permissions to create or restore backups (typically the server-admin or a project member with the backup operation permission).

Step 2 — Triggering the Vulnerable Codepath

The attacker sends a backup creation or restore request through the API, specifying a malicious compression algorithm string. Since the server does not validate the algorithm against an allowlist, the attacker's string is embedded into the command line verbatim.

Example request (illustrative):

POST /1.0/instances/target-container/backups
{
  "name": "backup1",
  "compression_algorithm": "gzip --help; touch /tmp/pwned"
}

The injection payload can include shell metacharacters (;, |, &&, backticks, $() ) to chain additional commands.

Step 3 — Payload Execution

The constructed command is executed with the privileges of the Incus daemon (typically root). Depending on the exact injection point, the attacker can achieve:

• Arbitrary File Write: The primary impact listed in the CVE description. The attacker can write to any file on the host filesystem. This could overwrite /etc/crontab to schedule a command, overwrite ~/.ssh/authorized_keys for a privileged user, or plant a web shell in an accessible directory.

• Arbitrary Command Execution: By chaining commands in the injected arguments, the attacker can execute arbitrary commands as the Incus daemon user (root in standard deployments).

Note: No public PoC is available for this CVE; the exact payload structure and command template are not disclosed. This exploitation scenario represents a plausible chain based on the vulnerability class.

Step 4 — Post-Exploitation

Once arbitrary file write or command execution is achieved, the attacker can:

• Escalate to full root access on the host (if not already running as root).
• Install persistent backdoors (systemd services, cron jobs, SSH keys).
• Pivot to other containers/VMs managed by Incus.
• Access secrets stored in container images or the Incus configuration (/etc/incus/).
• In cloud environments, potentially access cloud metadata endpoints (169.254.169.254) to obtain cloud credentials.

Impact Assessment

CVSS Score Analysis (9.9)

Business Impact

1. Complete Host Compromise: The Incus daemon runs as root; successful exploitation yields root on the host, compromising all workloads and data under management.

2. Multi-Tenant Data Leakage: In shared environments, a single low-privileged user can access all other tenants' data, violating isolation guarantees.

3. Supply Chain Risk: Incus is used in DevOps and infrastructure environments; compromise can lead to poisoned CI/CD pipelines or container images.

4. Regulatory Impact: For regulated industries (HIPAA, PCI-DSS), a host compromise involving multi-tenant data can trigger mandatory breach notification and compliance failures.

System Types at Highest Risk

• Internet-exposed Incus instances (even with authentication).
• Multi-tenant container hosting providers.
• Organizations using Incus for CI/CD or ephemeral infrastructure.
• Systems where incident response capabilities are limited (edge/IoT deployments).

Detection Guidance

Sigma Rule

title: Incus Backup Compression Argument Injection Attempt
id: 3e7f8b72-9c43-4ea5-b7d1-5e2f0a63c8d4
status: experimental
description: Detects attempts to exploit CVE-2026-48755 via malicious compression_algorithm parameters in Incus backup API requests
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-48755
author: Valtersit Threat Intel
date: 2026/06/15
tags:
    - attack.execution
    - attack.t1204
    - cve.2026.48755
logsource:
    category: application
    product: incus
    definition: Requires Incus API request logs
detection:
    selection:
        api_endpoint: "/1.0/instances/*/backups"
        method: "POST"
        body|contains|all:
            - "compression_algorithm"
    injection_patterns:
        body|re: "(compression_algorithm.*[;&|`$])"
    condition: selection and injection_patterns
level: high
falsepositives:
    - Unusual but legitimate compression algorithm names (unlikely given allowlist should exist)

YARA Rule

rule Incus_Backup_Arg_Injection_CVE_2026_48755 {
    meta:
        description = "Detects malicious payloads targeting CVE-2026-48755 in Incus backup API requests"
        author = "Valtersit Threat Intel"
        date = "2026-06-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-48755"
        severity = "critical"
    strings:
        $a = "compression_algorithm" nocase
        $b = "backups" nocase
        $c = /compression_algorithm["']?\s*[:=]\s*["']?[^"']*[;&|`$]/ nocase
        $d = /(gzip|bzip2|xz|zstd)[^"']*(--[a-z]+\s*=|;|&&|\|\|)/ nocase
    condition:
        $a and ($b or "instance") and ($c or $d)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-48755 Incus Backup Compression Algorithm Argument Injection"; flow:established,to_server; content:"POST"; http_method; content:"/backups"; http_uri; content:"compression_algorithm"; http_client_body; pcre:"/compression_algorithm[\"']?\s*[:=]\s*[\"']?[^\"']*[;&|`$]/i"; classtype:web-application-attack; sid:202648755; rev:1;)

Elastic Detection

sequence by host.name with maxspan=5s
  [ file where event.type == "change" and
    file.path like "*incus*" and
    file.extension in ("log", "json") and
    process.name == "incusd"
  ]
  [ process where process.name == "incusd" and
    process.command_line : "*--use-compress-program*" and
    (process.command_line : "*;*" or
     process.command_line : "*&&*" or
     process.command_line : "*|*" or
     process.command_line : "*`*" or
     process.command_line : "*$( *")
  ]

Splunk SPL Query

index=main sourcetype=incus:api
  method="POST"
  uri_path="*/backups*"
  | regex _raw="compression_algorithm[^,}]*[;&|`$]"
  | eval severity="CRITICAL"
  | eval cve="CVE-2026-48755"
  | table _time, src_ip, user, uri_path, _raw, severity, cve
  | sort -_time

Wazuh OSSEC Rule

<group name="incus,">
  <rule id="100255" level="15">
    <decoded_as>json</decoded_as>
    <field name="method">POST</field>
    <field name="uri" type="pcre2">/backups</field>
    <field name="body" type="pcre2">compression_algorithm[^}]*[;&|`$]</field>
    <description>Incus backup API request with suspicious compression_algorithm payload (CVE-2026-48755)</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>incus,cve-2026-48755,attack.execution,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence Assessment

Confidence Level: 3/4 (LIKELY) — Two independent sources (Incus upstream release notes and the Debian security tracker) confirm that version 7.1.0 addresses this vulnerability. The vendor has not issued an official security advisory at the time of writing, but the fix in the release notes is explicit about the input validation issue.

1) Immediate Mitigations (Until Patching)

• Restrict Backup API Access: Temporarily disable backup creation/restoration permissions for non-admin users:

  incus config set core.trust_password <new-password>
  # Remove backup permissions from non-admin users via RBAC policies
  

• Network Segmentation: Ensure the Incus API (port 8443) is not reachable from untrusted networks. Use firewalls or security groups to restrict access to trusted IP ranges.
• Run Incus Daemon with Least Privilege: While not a full mitigation, running the daemon as a non-root user (e.g., via namespace isolation) limits the blast radius.
• Audit Access Logs: Review backup API request logs for unusual compression_algorithm values.

2) Patch and Upgrade Steps

1. Check current version:

   incus version
   

2. Upgrade to Incus 7.1.0 or later:
   • Debian/Ubuntu:

     sudo apt update
     sudo apt install incus
     

   • Snap (official distribution):

     sudo snap install incus --channel=7.1/stable
     sudo snap refresh incus --channel=7.1/stable
     

   • Source build (from GitHub):

     git clone https://github.com/lxc/incus
     cd incus
     git checkout v7.1.0
     make
     sudo make install
     

3. Restart the daemon:

   systemctl restart incus
   

4. Verify:

   incus version
   # Should return 7.1.0 or higher
   

3) Long-Term Hardening

• Principle of Least Privilege (RBAC): Review and enforce RBAC policies. Only server-admin users should have backup/restore permissions in production.
• API Immutability: Implement a web application firewall (WAF) with rules to block request bodies containing shell metacharacters in the compression_algorithm field.
• Regular Auditing: Enable audit logging for all API requests (incus config set core.https_trusted_proxy=... plus access logging).
• Container Isolation: Run Incus daemon in a dedicated VM or container with restricted mount namespaces.
• Patch Automation: Subscribe to Incus security announcements and automate patch deployment.
• Monitor Threat Intel Feeds: Watch for any future PoC releases or exploit-in-the-wild evidence for this CVE.

References

1. NVD Entry: CVE-2026-48755 — NIST National Vulnerability Database
2. Incus Release Notes: Incus 7.1.0 Release Notes — Confirms patch for backup compression algorithm validation issue.
3. Debian Security Tracker: DSA-2026-48755 (if applicable) — Confirms fix in Debian packaging.
4. Incus GitHub Repository: lxc/incus — Source code and issue tracker.
5. Incus Official Website: https://linuxcontainers.org/incus/ — Project documentation and security announcements.

Exploit-in-the-Wild Evidence: At the time of this writing, no known public PoC, exploit code, or documented threat actor campaigns have been observed in the wild targeting CVE-2026-48755. The CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Organizations should treat this as a time-to-patch risk: given the high CVSS score (9.9) and the relative ease of exploitation (low privileges, network access), we anticipate that exploit code will likely surface following public disclosure, especially if the technical details become more widely disseminated.