# github.com/lxc/incus/v6 (Go) vulnerabilities 32 known vulnerabilities (9 critical, 10 high, 9 medium, 4 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v6.23.0 (Mar 27, 2026): affected by 24 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 32 since v6.0.1 (Jun 28, 2024) - Registry: https://pkg.go.dev/github.com/lxc/incus/v6 - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-55622: v6.0.1 to v6.23.0 (through the newest release) - CVE-2026-55621: v6.0.1 to v6.23.0 (through the newest release) - CVE-2026-48769: v6.0.1 to v6.23.0 (through the newest release) - CVE-2026-48755: v6.0.1 to v6.23.0 (through the newest release) - CVE-2026-48754: v6.0.1 to v6.23.0 (through the newest release) - CVE-2026-48753: v6.0.1 to v6.23.0 (through the newest release) - CVE-2026-48752: v6.0.1 to v6.23.0 (through the newest release) - CVE-2026-48751: v6.0.1 to v6.23.0 (through the newest release) - CVE-2026-48750: v6.0.1 to v6.23.0 (through the newest release) - CVE-2026-48749: v6.0.1 to v6.23.0 (through the newest release) - CVE-2026-47753: v6.0.1 to v6.23.0 (through the newest release) - CVE-2026-48756: v6.0.1 to v6.23.0 (through the newest release) - CVE-2026-41685: v6.0.1 to v6.23.0 (through the newest release) - CVE-2026-41684: v6.0.1 to v6.23.0 (through the newest release) - CVE-2026-41648: v6.0.1 to v6.23.0 (through the newest release) - CVE-2026-41647: v6.0.1 to v6.23.0 (through the newest release) - CVE-2026-40251: v6.0.1 to v6.23.0 (through the newest release) - CVE-2026-40243: v6.0.1 to v6.23.0 (through the newest release) - CVE-2026-40197: v6.0.1 to v6.23.0 (through the newest release) - CVE-2026-40195: v6.0.1 to v6.23.0 (through the newest release) - CVE-2026-35527: v6.0.1 to v6.23.0 (through the newest release) - CVE-2026-33945: v6.0.1 to v6.22.0 (v6.23.0 is outside it) - CVE-2026-33898: v6.0.1 to v6.22.0 (v6.23.0 is outside it) - CVE-2026-33897: v6.0.1 to v6.22.0 (v6.23.0 is outside it) - CVE-2026-33743: v6.0.1 to v6.22.0 (v6.23.0 is outside it) - CVE-2026-33711: v6.0.1 to v6.22.0 (v6.23.0 is outside it) - CVE-2026-33542: v6.0.1 to v6.22.0 (v6.23.0 is outside it) - CVE-2026-23954: v6.1.0 to v6.23.0 (through the newest release) - CVE-2026-23953: v6.0.1 to v6.23.0 (through the newest release) - CVE-2025-64507: v6.0.1 to v6.23.0 (through the newest release) - CVE-2025-52890: v6.12.0 to v6.13.0 (v6.14.0 is outside it) - CVE-2025-52889: v6.0.1 to v6.13.0 (v6.14.0 is outside it) ## Advisories (32) ### [CVE-2026-55622](https://cve.now/CVE-2026-55622): Incus has a project restriction bypass in instance copy across projects - Severity: High 7.7 - Published: Aug 21, 2026 - Affected: all versions. - No fix released. The latest release, v6.23.0, is still affected. ### [CVE-2026-55621](https://cve.now/CVE-2026-55621): Incus has a project restriction bypass for custom volume copy across projects - Severity: High 7.7 - Published: Aug 21, 2026 - Affected: through 6.23.0; all versions. - No fix released. The latest release, v6.23.0, is still affected. ### [CVE-2026-48769](https://cve.now/CVE-2026-48769): Incus has an arbitrary file write on its client due to trusted image hash - Severity: Critical 9.9 - Published: Aug 21, 2026 - Affected: all versions. - No fix released. The latest release, v6.23.0, is still affected. ### [CVE-2026-48755](https://cve.now/CVE-2026-48755): Incus has an argument injection in backup compression algorithm leading to AFW and ACE - Severity: Critical 9.9 - Published: Aug 21, 2026 - Affected: all versions. - No fix released. The latest release, v6.23.0, is still affected. ### [CVE-2026-48754](https://cve.now/CVE-2026-48754): Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} - Severity: Low 2.1 - Published: Aug 21, 2026 - Affected: all versions. - No fix released. The latest release, v6.23.0, is still affected. ### [CVE-2026-48753](https://cve.now/CVE-2026-48753): Incus has an arbitrary file write via path traversal in S3 multipart upload - Severity: Critical 9.9 - Published: Aug 21, 2026 - Affected: all versions. - No fix released. The latest release, v6.23.0, is still affected. ### [CVE-2026-48752](https://cve.now/CVE-2026-48752): Incus has arbitrary file read+write on host via templates/ symlink in malicious image - Severity: Critical 9.9 - Published: Aug 21, 2026 - Affected: all versions. - No fix released. The latest release, v6.23.0, is still affected. ### [CVE-2026-48751](https://cve.now/CVE-2026-48751): Incus has a restricted project bypass leading to arbitrary command execution - Severity: Critical 9.9 - Published: Aug 21, 2026 - Affected: all versions. - No fix released. The latest release, v6.23.0, is still affected. ### [CVE-2026-48750](https://cve.now/CVE-2026-48750): Incus has an arbitrary file write on host via \`exec-output\` symlink in crafted image - Severity: Critical 9.9 - Published: Aug 21, 2026 - Affected: all versions. - No fix released. The latest release, v6.23.0, is still affected. ### [CVE-2026-48749](https://cve.now/CVE-2026-48749): Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image - Severity: Critical 9.9 - Published: Aug 21, 2026 - Affected: all versions. - No fix released. The latest release, v6.23.0, is still affected. ### [CVE-2026-47753](https://cve.now/CVE-2026-47753): Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) - Severity: Medium 4.4 - Published: Aug 21, 2026 - Affected: all versions. - No fix released. The latest release, v6.23.0, is still affected. ### [CVE-2026-48756](https://cve.now/CVE-2026-48756): Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume\_snapshots\[\*\].expires\_at (sibling-field variant of GHSA-r7w7) - Severity: Low 2.1 - Published: Aug 21, 2026 - Affected: all versions. - No fix released. The latest release, v6.23.0, is still affected. ### [CVE-2026-41685](https://cve.now/CVE-2026-41685): Incus: Unbounded binary import disk exhaustion - Severity: Medium 4.3 - Published: May 7, 2026 - Affected: all versions. - No fix released. The latest release, v6.23.0, is still affected. ### [CVE-2026-41684](https://cve.now/CVE-2026-41684): Incus: Nil Dereferences on Restore via Malformed YAML - Severity: Medium 6.5 - Published: May 7, 2026 - Affected: all versions. - No fix released. The latest release, v6.23.0, is still affected. ### [CVE-2026-41648](https://cve.now/CVE-2026-41648): Incus: Unbounded YAML Metadata Decode via Parsing - Severity: Medium 5.3 - Published: May 7, 2026 - Affected: all versions. - No fix released. The latest release, v6.23.0, is still affected. ### [CVE-2026-41647](https://cve.now/CVE-2026-41647): Incus: Nil-Pointer Dereference via S3 Bucket Import - Severity: Medium 6.5 - Published: May 7, 2026 - Affected: all versions. - No fix released. The latest release, v6.23.0, is still affected. ### [CVE-2026-40251](https://cve.now/CVE-2026-40251): Incus out-of-bounds panic in snapshot metadata handling allows denial of service - Severity: High 7.1 - Published: May 6, 2026 - Affected: all versions. - No fix released. The latest release, v6.23.0, is still affected. ### [CVE-2026-40243](https://cve.now/CVE-2026-40243): Incus OVN TLS verification accepts peer-supplied roots and permits endpoint impersonation - Severity: Low 2.3 - Published: May 6, 2026 - Affected: all versions. - No fix released. The latest release, v6.23.0, is still affected. ### [CVE-2026-40197](https://cve.now/CVE-2026-40197): Incus nil-pointer dereference in custom volume import allows denial of service - Severity: High 7.1 - Published: May 6, 2026 - Affected: all versions. - No fix released. The latest release, v6.23.0, is still affected. ### [CVE-2026-40195](https://cve.now/CVE-2026-40195): Incus nil-pointer dereference in storage bucket import allows denial of service - Severity: High 7.1 - Published: May 6, 2026 - Affected: all versions. - No fix released. The latest release, v6.23.0, is still affected. ### [CVE-2026-35527](https://cve.now/CVE-2026-35527): Incus blind SSRF via image import preflight HEAD request - Severity: Medium 5.3 - Published: May 5, 2026 - Affected: all versions. - No fix released. The latest release, v6.23.0, is still affected. ### [CVE-2026-33945](https://cve.now/CVE-2026-33945): Abitrary file write through systemd-creds option - Severity: Critical 10.0 - Published: Mar 26, 2026 - Affected: fixed in 6.23.0. - Fixed in v6.23.0 (released Mar 27, 2026, 1 day after disclosure). - The latest release, v6.23.0, is not affected. ### [CVE-2026-33898](https://cve.now/CVE-2026-33898): Local Incus UI web server vulnerable to nuthentication bypass - Severity: High 8.8 - Published: Mar 26, 2026 - Affected: fixed in 6.23.0. - Fixed in v6.23.0 (released Mar 27, 2026, 1 day after disclosure). - The latest release, v6.23.0, is not affected. ### [CVE-2026-33897](https://cve.now/CVE-2026-33897): Incus vulnerable to arbitrary file read and write through pongo templates - Severity: Critical 10.0 - Published: Mar 26, 2026 - Affected: fixed in 6.23.0. - Fixed in v6.23.0 (released Mar 27, 2026, 1 day after disclosure). - The latest release, v6.23.0, is not affected. ### [CVE-2026-33743](https://cve.now/CVE-2026-33743): Incus vulnerable to denial of source through crafted bucket backup file - Severity: Medium 6.5 - Published: Mar 26, 2026 - Affected: fixed in 6.23.0. - Fixed in v6.23.0 (released Mar 27, 2026, 1 day after disclosure). - The latest release, v6.23.0, is not affected. ### [CVE-2026-33711](https://cve.now/CVE-2026-33711): Incus vulnerable to local privilege escalation through VM screenshot path - Severity: Medium 4.7 - Published: Mar 26, 2026 - Affected: fixed in 6.23.0. - Fixed in v6.23.0 (released Mar 27, 2026, 1 day after disclosure). - The latest release, v6.23.0, is not affected. ### [CVE-2026-33542](https://cve.now/CVE-2026-33542): Incus does not verify combined fingerprint when downloading images from simplestreams servers - Severity: Medium 5.7 - Published: Mar 26, 2026 - Affected: fixed in 6.23.0. - Fixed in v6.23.0 (released Mar 27, 2026, 1 day after disclosure). - The latest release, v6.23.0, is not affected. ### [CVE-2026-23954](https://cve.now/CVE-2026-23954): Incus container image templating arbitrary host file read and write - Severity: High 8.7 - Published: Jan 22, 2026 - Affected: from 6.1.0. - No fix released. The latest release, v6.23.0, is still affected. ### [CVE-2026-23953](https://cve.now/CVE-2026-23953): Incus container environment configuration newline injection - Severity: High 8.7 - Published: Jan 22, 2026 - Affected: fixed in 6.21.0; from 6.1.0. - No fix released. The latest release, v6.23.0, is still affected. ### [CVE-2025-64507](https://cve.now/CVE-2025-64507): Incus vulnerable to local privilege escalation through custom storage volumes - Severity: High 8.6 - Published: Nov 10, 2025 - Affected: from 6.1.0; fixed in 6.19.0. - No fix released. The latest release, v6.23.0, is still affected. ### [CVE-2025-52890](https://cve.now/CVE-2025-52890): Incus vulnerable to antispoofing nftables firewall rule bypass on bridge networks with ACLs - Severity: High 8.1 - Published: Jun 25, 2025 - Affected: from 6.12.0, fixed in 6.14.0. - Fixed in v6.14.0 (released Jun 27, 2025, 2 days after disclosure). - The latest release, v6.23.0, is not affected. ### [CVE-2025-52889](https://cve.now/CVE-2025-52889): Incus vulnerable to DoS through antispoofing nftables firewall rule bypass on bridge networks with ACLs - Severity: Low 3.4 - Published: Jun 25, 2025 - Affected: fixed in 6.14.0; from 6.12.0, fixed in 6.14.0. - Fixed in v6.14.0 (released Jun 27, 2025, 2 days after disclosure). - The latest release, v6.23.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/lxc/incus/v6 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.