Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/lxc/incus/v6

32 known vulnerabilities (9 critical, 10 high, 9 medium, 4 low), with the versions each affects and the releases that fix them.

Latest release
v6.23.0 (Mar 27, 2026): affected by 24 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
32 · 9 critical, 10 high, 9 medium, 4 low
Releases
32 since v6.0.1 (Jun 28, 2024)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Show all 32 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 32

  • Incus has a project restriction bypass in instance copy across projects

    Affected: all versions.

    No fix released. The latest release, v6.23.0, is still affected.

  • Incus has a project restriction bypass for custom volume copy across projects

    Affected: through 6.23.0; all versions.

    No fix released. The latest release, v6.23.0, is still affected.

  • CVE-2026-48769Critical 9.9

    Incus has an arbitrary file write on its client due to trusted image hash

    Affected: all versions.

    No fix released. The latest release, v6.23.0, is still affected.

  • CVE-2026-48755Critical 9.9

    Incus has an argument injection in backup compression algorithm leading to AFW and ACE

    Affected: all versions.

    No fix released. The latest release, v6.23.0, is still affected.

  • Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}

    Affected: all versions.

    No fix released. The latest release, v6.23.0, is still affected.

  • CVE-2026-48753Critical 9.9

    Incus has an arbitrary file write via path traversal in S3 multipart upload

    Affected: all versions.

    No fix released. The latest release, v6.23.0, is still affected.

  • CVE-2026-48752Critical 9.9

    Incus has arbitrary file read+write on host via templates/ symlink in malicious image

    Affected: all versions.

    No fix released. The latest release, v6.23.0, is still affected.

  • CVE-2026-48751Critical 9.9

    Incus has a restricted project bypass leading to arbitrary command execution

    Affected: all versions.

    No fix released. The latest release, v6.23.0, is still affected.

  • CVE-2026-48750Critical 9.9

    Incus has an arbitrary file write on host via `exec-output` symlink in crafted image

    Affected: all versions.

    No fix released. The latest release, v6.23.0, is still affected.

  • CVE-2026-48749Critical 9.9

    Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image

    Affected: all versions.

    No fix released. The latest release, v6.23.0, is still affected.

  • CVE-2026-47753Medium 4.4

    Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted)

    Affected: all versions.

    No fix released. The latest release, v6.23.0, is still affected.

  • Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)

    Affected: all versions.

    No fix released. The latest release, v6.23.0, is still affected.

  • CVE-2026-41685Medium 4.3

    Incus: Unbounded binary import disk exhaustion

    Affected: all versions.

    No fix released. The latest release, v6.23.0, is still affected.

  • CVE-2026-41684Medium 6.5

    Incus: Nil Dereferences on Restore via Malformed YAML

    Affected: all versions.

    No fix released. The latest release, v6.23.0, is still affected.

  • CVE-2026-41648Medium 5.3

    Incus: Unbounded YAML Metadata Decode via Parsing

    Affected: all versions.

    No fix released. The latest release, v6.23.0, is still affected.

Show all 32 advisoriesShow fewer advisories
  • CVE-2026-41647Medium 6.5

    Incus: Nil-Pointer Dereference via S3 Bucket Import

    Affected: all versions.

    No fix released. The latest release, v6.23.0, is still affected.

  • Incus out-of-bounds panic in snapshot metadata handling allows denial of service

    Affected: all versions.

    No fix released. The latest release, v6.23.0, is still affected.

  • Incus OVN TLS verification accepts peer-supplied roots and permits endpoint impersonation

    Affected: all versions.

    No fix released. The latest release, v6.23.0, is still affected.

  • Incus nil-pointer dereference in custom volume import allows denial of service

    Affected: all versions.

    No fix released. The latest release, v6.23.0, is still affected.

  • Incus nil-pointer dereference in storage bucket import allows denial of service

    Affected: all versions.

    No fix released. The latest release, v6.23.0, is still affected.

  • CVE-2026-35527Medium 5.3

    Incus blind SSRF via image import preflight HEAD request

    Affected: all versions.

    No fix released. The latest release, v6.23.0, is still affected.

  • CVE-2026-33945Critical 10.0

    Abitrary file write through systemd-creds option

    Affected: fixed in 6.23.0.

    Fixed in v6.23.0 (released Mar 27, 2026, 1 day after disclosure).

    The latest release, v6.23.0, is not affected.

  • Local Incus UI web server vulnerable to nuthentication bypass

    Affected: fixed in 6.23.0.

    Fixed in v6.23.0 (released Mar 27, 2026, 1 day after disclosure).

    The latest release, v6.23.0, is not affected.

  • CVE-2026-33897Critical 10.0

    Incus vulnerable to arbitrary file read and write through pongo templates

    Affected: fixed in 6.23.0.

    Fixed in v6.23.0 (released Mar 27, 2026, 1 day after disclosure).

    The latest release, v6.23.0, is not affected.

  • CVE-2026-33743Medium 6.5

    Incus vulnerable to denial of source through crafted bucket backup file

    Affected: fixed in 6.23.0.

    Fixed in v6.23.0 (released Mar 27, 2026, 1 day after disclosure).

    The latest release, v6.23.0, is not affected.

  • CVE-2026-33711Medium 4.7

    Incus vulnerable to local privilege escalation through VM screenshot path

    Affected: fixed in 6.23.0.

    Fixed in v6.23.0 (released Mar 27, 2026, 1 day after disclosure).

    The latest release, v6.23.0, is not affected.

  • CVE-2026-33542Medium 5.7

    Incus does not verify combined fingerprint when downloading images from simplestreams servers

    Affected: fixed in 6.23.0.

    Fixed in v6.23.0 (released Mar 27, 2026, 1 day after disclosure).

    The latest release, v6.23.0, is not affected.

  • Incus container image templating arbitrary host file read and write

    Affected: from 6.1.0.

    No fix released. The latest release, v6.23.0, is still affected.

  • Incus container environment configuration newline injection

    Affected: fixed in 6.21.0; from 6.1.0.

    No fix released. The latest release, v6.23.0, is still affected.

  • Incus vulnerable to local privilege escalation through custom storage volumes

    Affected: from 6.1.0; fixed in 6.19.0.

    No fix released. The latest release, v6.23.0, is still affected.

  • Incus vulnerable to antispoofing nftables firewall rule bypass on bridge networks with ACLs

    Affected: from 6.12.0, fixed in 6.14.0.

    Fixed in v6.14.0 (released Jun 27, 2025, 2 days after disclosure).

    The latest release, v6.23.0, is not affected.

  • Incus vulnerable to DoS through antispoofing nftables firewall rule bypass on bridge networks with ACLs

    Affected: fixed in 6.14.0; from 6.12.0, fixed in 6.14.0.

    Fixed in v6.14.0 (released Jun 27, 2025, 2 days after disclosure).

    The latest release, v6.23.0, is not affected.