CVE-2026-63343

Executive Summary

CVE-2026-63343 is a critical path traversal vulnerability (CWE-73) in Incus, a system container and virtual machine manager, affecting all versions prior to 7.3.0. An authenticated Incus user can exploit a malicious container image containing a metadata.yaml symlink that points to an arbitrary host path, allowing the user to read or overwrite any file on the host system with root privileges via the instance metadata API. The vulnerability carries a CVSS score of 9.9, indicating critical severity with high impact on confidentiality, integrity, and availability, and requires only low-privilege authenticated access with no user interaction. Version 7.3.0 patches the issue, and the fix has been independently confirmed by two sources including Debian.

Technical Analysis

The vulnerability resides in Incus's handling of container image metadata, specifically the metadata.yaml file. Incus is a modern system container and virtual machine manager, forked from LXD, that manages OCI-style container images. When an image is imported, Incus processes the image's metadata to configure the container or VM instance.

The core flaw is a symlink traversal vulnerability in the instance metadata API. A malicious actor can craft a container image where the metadata.yaml file is replaced with a symbolic link pointing to an arbitrary path on the host filesystem. When Incus processes this image and the metadata API is invoked to read or write instance metadata, the API follows the symlink and operates on the target host file path.

The attack is possible because of an inconsistent patch history. The NVD description explicitly notes that two related paths — exec-output and templates/ — were previously patched using two distinct mitigation techniques:

1. Lstat rejection: The Lstat system call retrieves file metadata without following symbolic links, allowing the code to detect and reject symlinks before opening the file.
2. os.OpenRoot confinement: This confines file operations to a specific directory root, preventing traversal outside that root context.

However, metadata.yaml was not included in either patch implementation. This omission means the metadata file path remains vulnerable to symlink resolution. When the instance metadata API processes this path, it follows the symlink to the arbitrary host target, e.g., /etc/shadow, /root/.ssh/authorized_keys, or any sensitive system file.

From a code-level perspective, the vulnerability is a classic TOCTOU (Time-of-Check to Time-of-Use) and symlink-following issue. The patched paths use Lstat to verify the file is not a symlink before opening, and os.OpenRoot to restrict the filesystem namespace. The metadata.yaml path bypasses both checks, so an attacker can control the file target through the image import process.

The attack surface is the Incus API, accessible over the network (CVSS vector shows AV:N). Authentication is required (PR:L), but only at a low privilege level — an unprivileged authenticated Incus user can exploit this. The scope is changed (S:C), meaning the impact crosses a trust boundary from the container/instance context to the host system. All three security objectives — confidentiality (C:H), integrity (I:H), and availability (A:H) — are rated high.

Exploitation Scenarios

The attack chain for CVE-2026-63343 is as follows:

1. Reconnaissance / Target Identification

An attacker first needs authenticated access to an Incus environment. This can be obtained through:

• A legitimate low-privileged account on an Incus deployment (e.g., a developer or CI/CD service account).
• Compromised credentials for an existing Incus user.
• A malicious image pushed to a shared image server that other Incus users pull.

The attacker then enumerates the Incus API endpoints, particularly those related to image management and instance metadata. The metadata.yaml file is processed automatically when an image is launched or when instance metadata is accessed.

2. Flaw Trigger

The attacker crafts a malicious container image where metadata.yaml is a symlink. For example:

image.tar.gz
├── metadata.yaml -> /etc/shadow
├── rootfs/
└── templates/

The attacker imports this image into Incus using the standard image import API. When the instance metadata API is invoked (e.g., to read or update instance configuration), Incus follows the symlink in metadata.yaml and resolves it to the host target path.

3. Payload / Execution Method

At the vulnerability-class level (symlink traversal with arbitrary read/write):

• Read primitive: The attacker triggers a metadata read operation (e.g., fetching instance metadata) which causes Incus to read the target file through the symlink and return its contents. This enables reading arbitrary host files such as /etc/shadow, SSH private keys, cloud credentials, or configuration secrets.
• Write primitive: The attacker triggers a metadata write operation, causing Incus to write attacker-supplied content to the target file. This enables overwriting files such as /root/.ssh/authorized_keys (to gain root SSH access), /etc/crontab (for command execution), or /etc/passwd (to create new privileged users).

Since Incus runs with root privileges on the host, all file operations occur as the root user.

4. Post-Exploitation Impact

After successful exploitation, the attacker achieves:

• Full host compromise: Arbitrary file read enables credential theft and intelligence gathering; arbitrary file write enables backdooring the host, installing persistence mechanisms, and modifying system binaries.
• Lateral movement: With host root access, the attacker can pivot to other containers/VMs managed by the same Incus instance.
• Data exfiltration: Sensitive host data can be extracted.
• Availability impact: The attacker could potentially corrupt critical system files, rendering the host inoperable.

No public PoC is available at the time of writing; the attack chain is inferred from the vulnerability class and the explicit description of symlink traversal in the NVD data.

Impact Assessment

Business Impact: CVE-2026-63343 represents a complete host compromise vector. The CVSS score of 9.9 (Critical) reflects the severity. The scoring breakdown:

• Attack Vector: Network (AV:N) — the vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) — no special conditions required.
• Privileges Required: Low (PR:L) — only an unprivileged authenticated user is needed.
• User Interaction: None (UI:N) — no victim action required.
• Scope: Changed (S:C) — the compromise extends beyond the container/instance boundary to the host OS.
• Confidentiality: High (C:H) — full host filesystem readable as root.
• Integrity: High (I:H) — arbitrary host files writable as root.
• Availability: High (A:H) — host can be rendered inoperable or used to disrupt other workloads.

Affected Systems: All Incus versions prior to 7.3.0. This affects any organization or individual using Incus as their container/VM management platform, including:

• Cloud service providers offering Incus-based container hosting.
• Enterprises running internal infrastructure-as-code environments with Incus.
• Single-host deployments where the administrator uses Incus for isolation.

Blast Radius: The scope change (S:C) means the impact extends from the container context to the host. Since Incus manages multiple instances, a compromise of the host grants control over all containers and VMs managed by that instance, making the blast radius effectively the entire host node.

Exploitability Assessment: The vulnerability requires only low-privileged authenticated access, making it highly exploitable. Any user with access to the Incus API is a potential attacker. The lack of user interaction lowers the barrier further. Combined with the network attack vector, this is a highly practical attack.

Detection Guidance

Detection of this vulnerability involves monitoring for anomalous file access patterns and symlink usage. The following rules should be adapted to your environment's logging capabilities.

Sigma Rule

title: Incus Metadata Symlink Traversal - CVE-2026-63343
id: c5764160-1f1e-4a2f-8b4e-1c6a4b1d3c2a
status: experimental
description: Detects attempts to exploit Incus metadata.yaml symlink traversal (CVE-2026-63343)
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-63343
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
    product: linux
    service: auditd
detection:
    selection_symlink:
        type: 'SYSCALL'
        syscall: 'symlinkat'
        key: 'incus_image_import'
    selection_metadata_write:
        type: 'SYSCALL'
        syscall: 'openat'
        a0|contains: 'metadata.yaml'
        key: 'incus_metadata'
    selection_host_files:
        type: 'SYSCALL'
        syscall: 'openat'
        a1|contains: 'O_NOFOLLOW'
    condition: selection_symlink or selection_metadata_write and not selection_host_files
level: critical
falsepositives:
    - Legitimate image metadata updates
tags:
    - cve.2026-63343
    - attack.t1213
    - attack.t1083

YARA Rule

rule CVE_2026_63343_Incus_Metadata_Symlink {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects Incus image archives containing malicious metadata.yaml symlinks (CVE-2026-63343)"
        cve = "CVE-2026-63343"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-63343"
        date = "2026-01-15"
    strings:
        $tarball = { 1F 8B }          // gzip magic
        $tar = { 75 73 74 61 72 }     // ustar
        $metadata = "metadata.yaml" ascii
        $symlink = "l" ascii 1        // symlink typeflag position
    condition:
        uint16(0) == 0x8B1F and $metadata and $symlink
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-63343 - Incus metadata.yaml Symlink Traversal Attempt";
    flow:to_server,established;
    content:"metadata.yaml";
    http_client_body;
    pcre:"/(symlink|ln\s|\.\.\/)/i";
    sid:10063343;
    rev:1;
    metadata:cve CVE-2026-63343;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-63343;
    classtype:attempted-admin;
)

Elastic Detection

sequence by process.entity_id
  [ file where event.action == "create" and file.name == "metadata.yaml" and
    file.extension == "tar.gz" and process.name == "incusd" ]
  [ file where event.action == "open" and file.path : "/etc/*" and
    process.name == "incusd" and not file.path : "/var/lib/incus/*" ]

Splunk SPL Query

index=linux sourcetype=auditd
( syscall=openat OR syscall=open )
| search (path="/etc/*" OR dest="/root/*") AND process_name=incusd
| table _time, host, user, process_name, path, dest, syscall
| eval is_metadata = if(path CONTAINS "metadata.yaml", "YES", "NO")
| where (is_metadata=YES OR dest=NO) OR (is_metadata="NO" AND path LIKE "/%")
| stats count by host, user, process_name, path
| where count > 3

Wazuh OSSEC Rule

<group name="incus,">
  <rule id="285185" level="12">
    <decoded_as>syscall</decoded_as>
    <field name="syscall">symlinkat</field>
    <description>Incus metadata.yaml symlink creation detected - possible CVE-2026-63343 exploitation</description>
    <group>cve-2026-63343,</group>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>

  <rule id="285186" level="12">
    <decoded_as>syscall</decoded_as>
    <field name="syscall">openat</field>
    <field name="path">/etc/|/root/</field>
    <description>Incus process opening sensitive host files outside container root - possible CVE-2026-63343 exploitation</description>
    <group>cve-2026-63343,</group>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 — LIKELY. Two independent sources (Incus upstream and Debian) confirm the fix in version 7.3.0.

1. Immediate Mitigations (if upgrade is not immediately possible):

• Restrict API access: If the Incus API is exposed on a network, restrict access to trusted internal networks only. Use firewall rules to limit connectivity.
• Enforce user review: Implement strict review processes for all image imports. Only allow images from trusted sources. Disable image auto-import and manually verify all images before use.
• Monitor metadata API access: Enable detailed audit logging for the Incus API and monitor for anomalous metadata access patterns.
• Run Incus in a restricted environment: If feasible, run Incus inside a VM or sandbox to limit the host filesystem exposure.

2. Patch / Upgrade Steps:

• Upgrade Incus to version 7.3.0 or later immediately. This is the definitive fix.
• On Debian-based systems: apt update && apt upgrade incus incusd
• On systems installed from source or snap: update the Incus snap or rebuild from the v7.3.0 tag.
• After upgrading, verify the upgrade: incus version should report 7.3.0 or later.
• Verify the patch: After upgrade, test that importing an image with a metadata.yaml symlink fails (the import should be rejected).

3. Long-Term Hardening:

• Regular patching cadence: Subscribe to Incus security announcements and patch promptly. The historical context here shows that patches to one code path may not cover all routes — audit patches for completeness.
• Least privilege: Review Incus user permissions. Do not grant image push/import permissions to untrusted users.
• Harden the host OS: Restrict file access further with SELinux/AppArmor profiles for the incusd process, if not already in place.
• Network segmentation: Place Incus API endpoints behind a reverse proxy with strict access control.
• Image signing: Enable mandatory image signature verification to prevent untrusted image import.
• Audit logging: Ensure auditd is enabled and archiving the Incus process activity for compliance review.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-63343
2. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-63343
3. Incus Official Website (upstream disclosure): https://linuxcontainers.org/incus/
4. Incus GitHub Repository (source and releases): https://github.com/lxc/incus
5. CWE-73 — External Control of File Name or Path: https://cwe.mitre.org/data/definitions/73.html

Threat Actor Intelligence: No known threat actor campaigns or exploit-in-the-wild evidence are currently documented for this CVE. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The PoC/exploit status is unknown at the time of this report; however, given the critical severity (9.9) and the straightforward symlink traversal mechanism, exploit development is considered likely in the near term. Organizations should treat this as a high-priority remediation target.