CVE-2026-48769

Executive Summary

CVE-2026-48769 is a high-severity arbitrary file write vulnerability in Incus, a system container and virtual machine manager. Prior to version 7.2.0, a malicious image server can return a crafted Incus-Image-Hash header that triggers an arbitrary file write in the Incus client, which can be leveraged to achieve arbitrary command execution as root on the server. The vulnerability carries a CVSS score of 9.9 with a scope-changed indicator, making it critical for any organization running vulnerable Incus versions. Users should upgrade to version 7.2.0 immediately, as no publicly known workarounds are documented.

Technical Analysis

Incus is a system container and virtual machine manager that provides a REST API and command-line client for managing containers, VMs, and images. The vulnerability lies in the image retrieval and verification flow of the Incus client. When a client pulls an image from a remote image server, the server responds with HTTP headers that include metadata about the image — one of which is the Incus-Image-Hash header, used to convey the hash of the image for integrity verification.

The failure is a classic insufficient input validation flaw (CWE-20). The client fails to properly validate or sanitize the value of the Incus-Image-Hash header before using it. Because this value is used in a file-write operation on the local filesystem, a malicious or compromised image server can inject a value that causes the client to write a file to an arbitrary location on the server's filesystem. The advisory indicates this is not limited to overwriting files within a specific directory — it is an arbitrary file write, meaning an attacker can write to any path the client process can access.

Since the Incus client often runs with elevated privileges (root) — particularly when used by administrators to manage system containers and virtual machines — the arbitrary file write can be leveraged for arbitrary command execution as root. A classic technique for achieving code execution from an arbitrary file write is to overwrite system configuration files, cron job definitions, or shell initialization scripts (e.g., /etc/cron.d/, /root/.bashrc, systemd unit files) that will be executed later with elevated privileges.

The attack surface is the image retrieval process itself. Any client that connects to a malicious image server — whether through a direct incus image import command, a remote image copy operation, or an automated deployment that references a compromised image source — is exposed to this flaw. The threat model is particularly relevant to organizations that use community or third-party image repositories, or where an attacker can perform a man-in-the-middle (MITM) attack to intercept and modify legitimate image server responses.

Notably, the attack requires low privileges to initiate (PR:L) but the impact extends to total compromise of the host (C:H/I:H/A:H) with a scope change (S:C), meaning the compromised component impacts resources beyond its original security scope. The lack of user interaction (UI:N) and the network attack vector (AV:N) further elevate the severity. The CVSS scoring reflects that exploitation is straightforward from a network position with low attacker complexity.

As of this writing, no public PoC or exploit code has been disclosed, and the technical details in advisory sources are sparse. The precise mechanism — how the header value flows into the file-write operation — is not publicly documented; however, the class of vulnerability (unvalidated input used in a path or file-write context) is well understood within the security community. It is reasonable to infer that the header value is concatenated with a directory path or used as a filename component, and that path traversal sequences (e.g., ../../) or absolute paths in the header value bypass the intended directory restriction.

Patch confidence is rated 3/4 (LIKELY), with two independent sources (Debian and vendor release notes) confirming the fix in version 7.2.0. The affected versions are all releases prior to 7.2.0, with no official enumeration of specific version numbers provided in the advisory data.

Exploitation Scenarios

Note: No public PoC or exploit code is available at the time of this writing. The following attack chain is inferred from the vulnerability class (arbitrary file write via unsanitized HTTP header value) and the NVD description.

Step 1 — Reconnaissance / Target Identification: An attacker first identifies Incus servers or clients that fetch images from remote or configurable image servers. Discovery vectors include Shodan queries for internet-exposed Incus instances, local network scan of ports commonly associated with Incus (HTTPS on 8443 is typical for the API), or identifying automation scripts and CI/CD pipelines that reference Incus image pulls. The attacker also identifies the image server that the target client trusts, which could be a default community repository or a custom internal registry.

Step 2 — Triggering the Flaw: The attacker sets up a malicious image server (or compromises an existing one). When the target Incus client initiates an image pull or image copy operation, the attacker's server responds with a crafted Incus-Image-Hash header. The header value is designed to manipulate the file-write operation performed by the client — for example, by containing path traversal sequences or absolute path references that redirect the write to an arbitrary location on the target filesystem. Because the client does not validate the header value (CWE-20), the malicious content is accepted and processed.

Step 3 — Payload / Execution Method: The attacker crafts the header value to cause the client to write attacker-controlled content to a sensitive location that leads to code execution. For example, writing a new cron job to /etc/cron.d/attacker or overwriting a systemd service file in /etc/systemd/system/. If the attacker can overwrite a file that is executed or sourced with root privileges (cron, systemd, shell profile), the arbitrary file write transitions directly into arbitrary command execution as root. Alternatively, the attacker could overwrite SSH authorized keys files, /etc/sudoers, or other configuration files to establish persistent access.

Step 4 — Post-Exploitation Impact: With arbitrary command execution as root, the attacker gains full control of the Incus server. The scope-change element of the CVSS vector (S:C) indicates the attacker can affect resources beyond the initially compromised component — in practice, all containers and virtual machines managed by the compromised Incus instance are at risk, along with any data accessible from the host. The attacker can pivot laterally into the container/VM workloads, exfiltrate sensitive data, establish persistence mechanisms, and potentially move to other systems on the network.

This attack chain does not require user interaction — the victim client merely needs to attempt an image fetch from the attacker-controlled server. In environments where Incus clients are integrated into automated provisioning or deployment pipelines, the exploitation window may be triggered without any manual operator action.

Impact Assessment

The business impact of CVE-2026-48769 is critical, as reflected in the CVSS base score of 9.9 out of 10.0. Breaking down the vector: the network attack vector (AV:N) means exploitation is remotely possible; low attack complexity (AC:L) indicates no special conditions or race conditions are required; low privileges (PR:L) means the attacker needs minimal authentication or access — possibly just the ability to serve an image; no user interaction (UI:N); and a scope change (S:C) confirms that the exploited vulnerability affects resources beyond the client component's security boundary.

The technical impact is severe across all three CIA dimensions: complete confidentiality loss (C:H) — the attacker can read any file on the compromised system; complete integrity loss (I:H) — arbitrary file write enables modification of any system file; and complete availability loss (A:H) — the attacker can disrupt services, delete or corrupt files, or render the system inoperable.

Affected systems include all Incus deployments running versions prior to 7.2.0. Given that Incus is a system container and virtual machine manager, the blast radius extends beyond the host to every workload managed by the compromised instance. A single exploited image pull can result in complete host takeover, which effectively hands an attacker the keys to the entire virtualized infrastructure managed by that Incus server.

Organizations most at risk include infrastructure-as-a-service providers, DevOps teams using Incus for continuous integration environments, and enterprises running containerized or VM-based workloads on Incus. Environments that pull images from untrusted or community-sourced repositories face elevated risk, as do those that have not tightly controlled the image source configuration on client nodes.

No evidence of CISA KEV listing, public PoC, or active in-the-wild exploitation has been reported to date; however, given the ease of exploitation and the high reward (root-level compromise), this vulnerability is expected to attract threat actor attention rapidly.

Detection Guidance

Sigma Rule

title: Incus Arbitrary File Write via Malicious Incus-Image-Hash Header
id: 5f5fe89c-4a8f-4c35-9a2d-7d3c0f2762e4
status: experimental
description: Detects suspicious file write operations and processes spawned by the incus client when fetching images, potentially exploiting CVE-2026-48769.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-48769
author: valtersit.com Threat Intelligence
date: 2026/05/15
logsource:
    category: process_creation
    product: linux
detection:
    selection_incus:
        Image|endswith:
            - '/incus'
            - '/incusd'
            - '/incus-client'
    selection_write:
        TargetFilename|startswith:
            - '/etc/cron.d/'
            - '/etc/systemd/system/'
            - '/root/.bashrc'
            - '/etc/sudoers'
            - '/root/.ssh/authorized_keys'
    condition: selection_incus and selection_write
falsepositives:
    - Legitimate Incus image pulls that write configuration files as part of normal operation
level: high

YARA Rule

rule Incus_CVE_2026_48769_Hash_Header {
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects crafted Incus-Image-Hash headers used in CVE-2026-48769 exploitation"
        cve = "CVE-2026-48769"
        date = "2025-05-15"
        severity = "critical"
    strings:
        $header = "Incus-Image-Hash:" ascii nocase
        $traversal = "../../" ascii
        $abs_path = "/etc/" ascii
        $shell_cmd = "/bin/sh" ascii
        $cron = "cron.d" ascii
    condition:
        $header and (
            $traversal or $abs_path or $shell_cmd or $cron
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-48769 - Incus Malicious Image Server Response Header"; flow:established,to_client; http.response_body; content:"Incus-Image-Hash"; http_header; pcre:"/(?i)Incus-Image-Hash:\s*(\.\.|file:|/etc/|/root/)/"; classtype:attempted-admin; sid:58476901; rev:1; reference:cve,2026-48769;)

Elastic Detection

sequence by host.name, process.parent.entity_id with maxspan=30s
  [process where event.type == "start" and process.name in ("incus", "incusd", "incus-client") and process.args in ("image pull", "image copy", "image import")]
  [file where event.type == "creation" and file.path in (
     "/etc/cron.d/*",
     "/etc/systemd/system/*",
     "/root/.bashrc",
     "/etc/sudoers",
     "/root/.ssh/authorized_keys"
  )]

Splunk SPL Query

index=linux earliest=-24h
| where (ProcessName IN ("incus", "incusd", "incus-client") AND CommandLine IN ("*image pull*", "*image copy*", "*image import*"))
| join type=outer dest_host
    [search index=filesystemFileDeletion OR index=linux
    | where FilePath LIKE "/etc/cron.d/%" OR FilePath LIKE "/etc/systemd/system/%" OR FilePath IN ("/root/.bashrc", "/etc/sudoers", "/root/.ssh/authorized_keys")]
| table _time, host, ProcessName, CommandLine, FilePath
| sort - _time

Wazuh OSSEC Rule

<group name="incus,">
    <rule id="487690" level="14">
        <decoded>incus</decoded>
        <match>Incus-Image-Hash</match>
        <regex>\.\.|/etc/|/root/|file:</regex>
        <description>Possible CVE-2026-48769 exploitation: malicious Incus-Image-Hash header detected</description>
        <mitre>
            <id>T1190</id>
            <ref>https://attack.mitre.org/techniques/T1190/</ref>
        </mitre>
        <group>incus,attack_exploitation,cve-2026-48769</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 (LIKELY) — two independent sources confirm the fix in version 7.2.0.

Immediate Mitigations:

1. Restrict outbound network access from Incus client systems to only trusted and vetted image servers.
2. Implement TLS with certificate pinning for all Incus image repository connections to prevent MITM interception.
3. Run Incus client operations with the least privilege required — avoid running image pulls as root where job functions allow.
4. Egress firewall rules should block client systems from connecting to unexpected or untrusted hosts on port 443/8443 if image pulls are not required to be broadly accessible.
5. Monitor file system integrity for unexpected writes to system directories (e.g., /etc/, /root/, /var/spool/cron/) using file integrity monitoring (FIM) tools.

Patch / Upgrade Steps:

1. Upgrade Incus to version 7.2.0 or later on all client systems and servers. This is the definitive fix per the advisory.
2. For Debian-based distributions, apply the package update from Debian security repositories as soon as it propagates to your mirrors.
3. If a direct upgrade to 7.2.0 is not immediately possible, pin the Incus client version to a known safe version or disable image pull operations entirely until patching is complete.
4. After patching, verify the installed version with incus version or equivalent command to confirm the update was applied.
5. Validate that all Incus nodes in the environment have been patched — a single unpatched client remains exploitable.

Long-Term Hardening:

1. Establish a formal image provenance policy: only pull images from internal mirrors that are vetted and signed, and that are maintained behind controlled infrastructure.
2. Implement network-level segmentation so that Incus management traffic cannot traverse untrusted network zones.
3. Adopt a routine vulnerability management cadence that tracks NVD and vendor advisories for Incus and adjacent tooling.
4. Enable comprehensive audit logging on all Incus servers and centralize these logs into a SIEM for correlation with detection rules above.
5. Periodically review image server certificates and configuration to ensure no unauthorized endpoints have been introduced into client trust stores.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-48769 — Official CVE record with technical description and CVSS vector.
2. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-48769 — Independent confirmation of patch availability in version 7.2.0.
3. Incus Official Documentation / Release Notes: https://linuxcontainers.org/incus/docs/main/ — Source of version 7.2.0 release information and changelog (confirm release notes page for specific fix).
4. MITRE ATT&CK Framework: https://attack.mitre.org/techniques/T1190/ — Technique mapping for exploitation of public-facing applications.
5. CWE-20 Registry: https://cwe.mitre.org/data/definitions/20.html — Weakness class reference for improper input validation.

As of the publication date of this report, there is no evidence of exploitation in the wild, no CISA KEV listing, and no known threat actor campaigns targeting this vulnerability. This status is subject to change rapidly given the high severity and relatively straightforward exploitation mechanics.