Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/lxc/incus/v7

17 known vulnerabilities (7 critical, 5 high, 2 medium, 3 low), with the versions each affects and the releases that fix them.

Latest release
v7.6.0 (Oct 30, 2026): no advisory affects it
Newest unaffected release
v7.6.0 (Oct 30, 2026), the latest release
Advisories
17 · 7 critical, 5 high, 2 medium, 3 low
Releases
10 since v7.0.0 (May 1, 2026)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Show all 17 advisoriesShow fewer advisories
  • CVE-2026-40251
    No published release is affected
    No published release is affected
  • CVE-2026-40243
    No published release is affected
    No published release is affected
  • CVE-2026-40197
    No published release is affected
    No published release is affected
  • CVE-2026-40195
    No published release is affected
    No published release is affected
  • CVE-2026-35527
    No published release is affected
    No published release is affected
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 17

  • Incus has a project restriction bypass in instance copy across projects

    Affected: fixed in 7.2.0.

    Fixed in v7.2.0 (released Jun 26, 2026, 56 days before disclosure).

    The latest release, v7.6.0, is not affected.

  • Incus has a project restriction bypass for custom volume copy across projects

    Affected: fixed in 7.2.0.

    Fixed in v7.2.0 (released Jun 26, 2026, 56 days before disclosure).

    The latest release, v7.6.0, is not affected.

  • CVE-2026-48769Critical 9.9

    Incus has an arbitrary file write on its client due to trusted image hash

    Affected: fixed in 7.2.0.

    Fixed in v7.2.0 (released Jun 26, 2026, 56 days before disclosure).

    The latest release, v7.6.0, is not affected.

  • CVE-2026-48755Critical 9.9

    Incus has an argument injection in backup compression algorithm leading to AFW and ACE

    Affected: fixed in 7.2.0.

    Fixed in v7.2.0 (released Jun 26, 2026, 56 days before disclosure).

    The latest release, v7.6.0, is not affected.

  • Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}

    Affected: fixed in 7.1.0.

    Fixed in v7.1.0 (released May 29, 2026, 84 days before disclosure).

    The latest release, v7.6.0, is not affected.

  • CVE-2026-48753Critical 9.9

    Incus has an arbitrary file write via path traversal in S3 multipart upload

    Affected: fixed in 7.1.0.

    Fixed in v7.1.0 (released May 29, 2026, 84 days before disclosure).

    The latest release, v7.6.0, is not affected.

  • CVE-2026-48752Critical 9.9

    Incus has arbitrary file read+write on host via templates/ symlink in malicious image

    Affected: fixed in 7.2.0.

    Fixed in v7.2.0 (released Jun 26, 2026, 56 days before disclosure).

    The latest release, v7.6.0, is not affected.

  • CVE-2026-48751Critical 9.9

    Incus has a restricted project bypass leading to arbitrary command execution

    Affected: fixed in 7.2.0.

    Fixed in v7.2.0 (released Jun 26, 2026, 56 days before disclosure).

    The latest release, v7.6.0, is not affected.

  • CVE-2026-48750Critical 9.9

    Incus has an arbitrary file write on host via `exec-output` symlink in crafted image

    Affected: fixed in 7.2.0.

    Fixed in v7.2.0 (released Jun 26, 2026, 56 days before disclosure).

    The latest release, v7.6.0, is not affected.

  • CVE-2026-48749Critical 9.9

    Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image

    Affected: fixed in 7.2.0.

    Fixed in v7.2.0 (released Jun 26, 2026, 56 days before disclosure).

    The latest release, v7.6.0, is not affected.

  • CVE-2026-47753Medium 4.4

    Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted)

    Affected: fixed in 7.1.0.

    Fixed in v7.1.0 (released May 29, 2026, 84 days before disclosure).

    The latest release, v7.6.0, is not affected.

  • Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)

    Affected: fixed in 7.1.0.

    Fixed in v7.1.0 (released May 29, 2026, 84 days before disclosure).

    The latest release, v7.6.0, is not affected.

  • Incus out-of-bounds panic in snapshot metadata handling allows denial of service

    Affected: fixed in 7.0.0.

    Fixed in v7.0.0 (released May 1, 2026, 5 days before disclosure).

    The latest release, v7.6.0, is not affected.

  • Incus OVN TLS verification accepts peer-supplied roots and permits endpoint impersonation

    Affected: fixed in 7.0.0.

    Fixed in v7.0.0 (released May 1, 2026, 5 days before disclosure).

    The latest release, v7.6.0, is not affected.

  • Incus nil-pointer dereference in custom volume import allows denial of service

    Affected: fixed in 7.0.0.

    Fixed in v7.0.0 (released May 1, 2026, 5 days before disclosure).

    The latest release, v7.6.0, is not affected.

Show all 17 advisoriesShow fewer advisories

  • Incus nil-pointer dereference in storage bucket import allows denial of service

    Affected: fixed in 7.0.0.

    Fixed in v7.0.0 (released May 1, 2026, 5 days before disclosure).

    The latest release, v7.6.0, is not affected.

  • CVE-2026-35527Medium 5.3

    Incus blind SSRF via image import preflight HEAD request

    Affected: fixed in 7.0.0.

    Fixed in v7.0.0 (released May 1, 2026, 4 days before disclosure).

    The latest release, v7.6.0, is not affected.