# github.com/lxc/incus/v7 (Go) vulnerabilities 17 known vulnerabilities (7 critical, 5 high, 2 medium, 3 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v7.6.0 (Oct 30, 2026): no advisory affects it - Newest unaffected release: v7.6.0 (Oct 30, 2026), the latest release - Releases: 10 since v7.0.0 (May 1, 2026) - Registry: https://pkg.go.dev/github.com/lxc/incus/v7 - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-55622: v7.0.0 to v7.1.0 (v7.2.0 is outside it) - CVE-2026-55621: v7.0.0 to v7.1.0 (v7.2.0 is outside it) - CVE-2026-48769: v7.0.0 to v7.1.0 (v7.2.0 is outside it) - CVE-2026-48755: v7.0.0 to v7.1.0 (v7.2.0 is outside it) - CVE-2026-48754: v7.0.0 to v7.0.2 (v7.1.0 is outside it) - CVE-2026-48753: v7.0.0 to v7.0.2 (v7.1.0 is outside it) - CVE-2026-48752: v7.0.0 to v7.1.0 (v7.2.0 is outside it) - CVE-2026-48751: v7.0.0 to v7.1.0 (v7.2.0 is outside it) - CVE-2026-48750: v7.0.0 to v7.1.0 (v7.2.0 is outside it) - CVE-2026-48749: v7.0.0 to v7.1.0 (v7.2.0 is outside it) - CVE-2026-47753: v7.0.0 to v7.0.2 (v7.1.0 is outside it) - CVE-2026-48756: v7.0.0 to v7.0.2 (v7.1.0 is outside it) - CVE-2026-40251: no published release is affected - CVE-2026-40243: no published release is affected - CVE-2026-40197: no published release is affected - CVE-2026-40195: no published release is affected - CVE-2026-35527: no published release is affected ## Advisories (17) ### [CVE-2026-55622](https://cve.now/CVE-2026-55622): Incus has a project restriction bypass in instance copy across projects - Severity: High 7.7 - Published: Aug 21, 2026 - Affected: fixed in 7.2.0. - Fixed in v7.2.0 (released Jun 26, 2026, 56 days before disclosure). - The latest release, v7.6.0, is not affected. ### [CVE-2026-55621](https://cve.now/CVE-2026-55621): Incus has a project restriction bypass for custom volume copy across projects - Severity: High 7.7 - Published: Aug 21, 2026 - Affected: fixed in 7.2.0. - Fixed in v7.2.0 (released Jun 26, 2026, 56 days before disclosure). - The latest release, v7.6.0, is not affected. ### [CVE-2026-48769](https://cve.now/CVE-2026-48769): Incus has an arbitrary file write on its client due to trusted image hash - Severity: Critical 9.9 - Published: Aug 21, 2026 - Affected: fixed in 7.2.0. - Fixed in v7.2.0 (released Jun 26, 2026, 56 days before disclosure). - The latest release, v7.6.0, is not affected. ### [CVE-2026-48755](https://cve.now/CVE-2026-48755): Incus has an argument injection in backup compression algorithm leading to AFW and ACE - Severity: Critical 9.9 - Published: Aug 21, 2026 - Affected: fixed in 7.2.0. - Fixed in v7.2.0 (released Jun 26, 2026, 56 days before disclosure). - The latest release, v7.6.0, is not affected. ### [CVE-2026-48754](https://cve.now/CVE-2026-48754): Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} - Severity: Low 2.1 - Published: Aug 21, 2026 - Affected: fixed in 7.1.0. - Fixed in v7.1.0 (released May 29, 2026, 84 days before disclosure). - The latest release, v7.6.0, is not affected. ### [CVE-2026-48753](https://cve.now/CVE-2026-48753): Incus has an arbitrary file write via path traversal in S3 multipart upload - Severity: Critical 9.9 - Published: Aug 21, 2026 - Affected: fixed in 7.1.0. - Fixed in v7.1.0 (released May 29, 2026, 84 days before disclosure). - The latest release, v7.6.0, is not affected. ### [CVE-2026-48752](https://cve.now/CVE-2026-48752): Incus has arbitrary file read+write on host via templates/ symlink in malicious image - Severity: Critical 9.9 - Published: Aug 21, 2026 - Affected: fixed in 7.2.0. - Fixed in v7.2.0 (released Jun 26, 2026, 56 days before disclosure). - The latest release, v7.6.0, is not affected. ### [CVE-2026-48751](https://cve.now/CVE-2026-48751): Incus has a restricted project bypass leading to arbitrary command execution - Severity: Critical 9.9 - Published: Aug 21, 2026 - Affected: fixed in 7.2.0. - Fixed in v7.2.0 (released Jun 26, 2026, 56 days before disclosure). - The latest release, v7.6.0, is not affected. ### [CVE-2026-48750](https://cve.now/CVE-2026-48750): Incus has an arbitrary file write on host via \`exec-output\` symlink in crafted image - Severity: Critical 9.9 - Published: Aug 21, 2026 - Affected: fixed in 7.2.0. - Fixed in v7.2.0 (released Jun 26, 2026, 56 days before disclosure). - The latest release, v7.6.0, is not affected. ### [CVE-2026-48749](https://cve.now/CVE-2026-48749): Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image - Severity: Critical 9.9 - Published: Aug 21, 2026 - Affected: fixed in 7.2.0. - Fixed in v7.2.0 (released Jun 26, 2026, 56 days before disclosure). - The latest release, v7.6.0, is not affected. ### [CVE-2026-47753](https://cve.now/CVE-2026-47753): Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) - Severity: Medium 4.4 - Published: Aug 21, 2026 - Affected: fixed in 7.1.0. - Fixed in v7.1.0 (released May 29, 2026, 84 days before disclosure). - The latest release, v7.6.0, is not affected. ### [CVE-2026-48756](https://cve.now/CVE-2026-48756): Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume\_snapshots\[\*\].expires\_at (sibling-field variant of GHSA-r7w7) - Severity: Low 2.1 - Published: Aug 21, 2026 - Affected: fixed in 7.1.0. - Fixed in v7.1.0 (released May 29, 2026, 84 days before disclosure). - The latest release, v7.6.0, is not affected. ### [CVE-2026-40251](https://cve.now/CVE-2026-40251): Incus out-of-bounds panic in snapshot metadata handling allows denial of service - Severity: High 7.1 - Published: May 6, 2026 - Affected: fixed in 7.0.0. - Fixed in v7.0.0 (released May 1, 2026, 5 days before disclosure). - The latest release, v7.6.0, is not affected. ### [CVE-2026-40243](https://cve.now/CVE-2026-40243): Incus OVN TLS verification accepts peer-supplied roots and permits endpoint impersonation - Severity: Low 2.3 - Published: May 6, 2026 - Affected: fixed in 7.0.0. - Fixed in v7.0.0 (released May 1, 2026, 5 days before disclosure). - The latest release, v7.6.0, is not affected. ### [CVE-2026-40197](https://cve.now/CVE-2026-40197): Incus nil-pointer dereference in custom volume import allows denial of service - Severity: High 7.1 - Published: May 6, 2026 - Affected: fixed in 7.0.0. - Fixed in v7.0.0 (released May 1, 2026, 5 days before disclosure). - The latest release, v7.6.0, is not affected. ### [CVE-2026-40195](https://cve.now/CVE-2026-40195): Incus nil-pointer dereference in storage bucket import allows denial of service - Severity: High 7.1 - Published: May 6, 2026 - Affected: fixed in 7.0.0. - Fixed in v7.0.0 (released May 1, 2026, 5 days before disclosure). - The latest release, v7.6.0, is not affected. ### [CVE-2026-35527](https://cve.now/CVE-2026-35527): Incus blind SSRF via image import preflight HEAD request - Severity: Medium 5.3 - Published: May 5, 2026 - Affected: fixed in 7.0.0. - Fixed in v7.0.0 (released May 1, 2026, 4 days before disclosure). - The latest release, v7.6.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/lxc/incus/v7 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.