# cve.now: LXC

The newest entries naming LXC as an affected vendor (up to 200), of 51 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-100395](https://cve.now/CVE-2026-100395.md): LXC: lxc-copy host-context hostname update follows symlink (CVSS 6.8)
- [CVE-2026-115378](https://cve.now/CVE-2026-115378.md): Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pull (CVSS 6.9)
- [CVE-2026-115377](https://cve.now/CVE-2026-115377.md): Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream (CVSS 9.4)
- [CVE-2026-115376](https://cve.now/CVE-2026-115376.md): Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 Project Restriction Bypass via Custom Volume Copy (CVSS 8.3)
- [CVE-2026-115375](https://cve.now/CVE-2026-115375.md): Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes (CVSS 9.4)
- [CVE-2026-115374](https://cve.now/CVE-2026-115374.md): Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Unsigned Header Bypass in Presigned S3 Upload URLs (CVSS 7.1)
- [CVE-2026-115373](https://cve.now/CVE-2026-115373.md): Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid} (CVSS 7.0)
- [CVE-2026-115372](https://cve.now/CVE-2026-115372.md): Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create\_options (CVSS 9.0)
- [CVE-2026-115371](https://cve.now/CVE-2026-115371.md): LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys Endpoints (CVSS 7.1)
- [CVE-2026-115370](https://cve.now/CVE-2026-115370.md): Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh (CVSS 5.3)
- [CVE-2026-52727](https://cve.now/CVE-2026-52727.md): lxc-ci: Pacman keyring stored in archlinux image with a private key (CVSS 7.2)
- [CVE-2026-63343](https://cve.now/CVE-2026-63343.md): Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root (CVSS 9.9)
- [CVE-2026-63125](https://cve.now/CVE-2026-63125.md): Incus vulnerable to root RCE via image backup.yaml symlink (CVSS 9.9)
- [CVE-2026-62941](https://cve.now/CVE-2026-62941.md): Incus: Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge (CVSS 9.9)
- [CVE-2026-62940](https://cve.now/CVE-2026-62940.md): Incus has a project restriction bypass via instance migration config override (CVSS 9.9)
- [CVE-2026-62867](https://cve.now/CVE-2026-62867.md): Incus has an argument injection in storage volume block.create\_options that leads to arbitrary command execution (CVSS 9.9)
- [CVE-2026-62313](https://cve.now/CVE-2026-62313.md): Incus: Project restriction \`restricted.containers.privilege=isolated\` bypassable by omitting \`security.idmap.isolated\` (CVSS 4.3)
- [CVE-2026-55622](https://cve.now/CVE-2026-55622.md): Incus has a project restriction bypass in instance copy across projects (CVSS 7.7)
- [CVE-2026-55621](https://cve.now/CVE-2026-55621.md): Incus has a project restriction bypass for custom volume copy across projects (CVSS 7.7)
- [CVE-2026-48769](https://cve.now/CVE-2026-48769.md): Incus has an arbitrary file write on its client due to trusted image hash (CVSS 9.9)
- [CVE-2026-48755](https://cve.now/CVE-2026-48755.md): Incus has an argument injection in backup compression algorithm leading to AFW and ACE (CVSS 9.9)
- [CVE-2026-48754](https://cve.now/CVE-2026-48754.md): Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} (CVSS 2.1)
- [CVE-2026-48753](https://cve.now/CVE-2026-48753.md): Incus has an arbitrary file write via path traversal in S3 multipart upload (CVSS 9.9)
- [CVE-2026-48752](https://cve.now/CVE-2026-48752.md): Incus has arbitrary file read+write on host via templates/ symlink in malicious image (CVSS 9.9)
- [CVE-2026-48751](https://cve.now/CVE-2026-48751.md): Incus has a restricted project bypass leading to arbitrary command execution (CVSS 9.9)
- [CVE-2026-48750](https://cve.now/CVE-2026-48750.md): Incus has an arbitrary file write on host via \`exec-output\` symlink in crafted image (CVSS 9.9)
- [CVE-2026-48749](https://cve.now/CVE-2026-48749.md): Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image (CVSS 9.9)
- [CVE-2026-47753](https://cve.now/CVE-2026-47753.md): Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) (CVSS 4.4)
- [CVE-2026-48756](https://cve.now/CVE-2026-48756.md): Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume\_snapshots\[\*\].expires\_at (sibling-field variant of GHSA-r7w7) (CVSS 2.1)
- [CVE-2026-41685](https://cve.now/CVE-2026-41685.md): Incus: Unbounded binary import disk exhaustion (CVSS 4.3)
- [CVE-2026-41684](https://cve.now/CVE-2026-41684.md): Incus: Nil Dereferences on Restore via Malformed YAML (CVSS 6.5)
- [CVE-2026-41648](https://cve.now/CVE-2026-41648.md): Incus: Unbounded YAML Metadata Decode via Parsing (CVSS 5.3)
- [CVE-2026-41647](https://cve.now/CVE-2026-41647.md): Incus: Nil-Pointer Dereference via S3 Bucket Import (CVSS 6.5)
- [CVE-2026-40251](https://cve.now/CVE-2026-40251.md): Incus out-of-bounds panic in snapshot metadata handling allows denial of service (CVSS 7.1)
- [CVE-2026-40243](https://cve.now/CVE-2026-40243.md): Incus OVN TLS verification accepts peer-supplied roots and permits endpoint impersonation (CVSS 2.3)
- [CVE-2026-40197](https://cve.now/CVE-2026-40197.md): Incus nil-pointer dereference in custom volume import allows denial of service (CVSS 7.1)
- [CVE-2026-40195](https://cve.now/CVE-2026-40195.md): Incus nil-pointer dereference in storage bucket import allows denial of service (CVSS 7.1)
- [CVE-2026-39402](https://cve.now/CVE-2026-39402.md): lxc lxc-user-nic insufficient ownership validation allows cross-tenant OVS port deletion (CVSS 4.3)
- [CVE-2026-35527](https://cve.now/CVE-2026-35527.md): Incus blind SSRF via image import preflight HEAD request (CVSS 5.3)
- [CVE-2026-33945](https://cve.now/CVE-2026-33945.md): Abitrary file write through systemd-creds option (CVSS 10.0)
- [CVE-2026-33898](https://cve.now/CVE-2026-33898.md): Local Incus UI web server vulnerable to nuthentication bypass (CVSS 8.8)
- [CVE-2026-33897](https://cve.now/CVE-2026-33897.md): Incus vulnerable to arbitrary file read and write through pongo templates (CVSS 10.0)
- [CVE-2026-33743](https://cve.now/CVE-2026-33743.md): Incus vulnerable to denial of source through crafted bucket backup file (CVSS 6.5)
- [CVE-2026-33711](https://cve.now/CVE-2026-33711.md): Incus vulnerable to local privilege escalation through VM screenshot path (CVSS 4.7)
- [CVE-2026-33542](https://cve.now/CVE-2026-33542.md): Incus does not verify combined fingerprint when downloading images from simplestreams servers (CVSS 5.7)
- [CVE-2026-32606](https://cve.now/CVE-2026-32606.md): IncusOS has a LUKS encryption bypass due to insufficient TPM policy (CVSS 7.7)
- [CVE-2026-23954](https://cve.now/CVE-2026-23954.md): Incus container image templating arbitrary host file read and write (CVSS 8.7)
- [CVE-2026-23953](https://cve.now/CVE-2026-23953.md): Incus container environment configuration newline injection (CVSS 8.7)
- [CVE-2025-64507](https://cve.now/CVE-2025-64507.md): Incus vulnerable to local privilege escalation through custom storage volumes (CVSS 8.6)
- [CVE-2025-52890](https://cve.now/CVE-2025-52890.md): Incus vulnerable to antispoofing nftables firewall rule bypass on bridge networks with ACLs (CVSS 8.1)
- [CVE-2025-52889](https://cve.now/CVE-2025-52889.md): Incus vulnerable to DoS through antispoofing nftables firewall rule bypass on bridge networks with ACLs (CVSS 3.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/lxc
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.