Incus vulnerability allows arbitrary file writes via malicious migration sources
A critical flaw in Incus container management software enables attackers to write host files by planting symlinks in transferred volumes during migration.
Key points
- CVE-2026-115377 is rated Critical with a CVSS score of 9.4
- The flaw affects Incus versions before 6.0.7, 7.0.2, and 7.5.0
- Attackers can achieve full host compromise by writing files as root
Incus container management software contains a critical arbitrary file write vulnerability that allows attackers to compromise host systems through malicious migration sources. The flaw, identified as CVE-2026-115377, enables the writing of host files by planting symbolic links in transferred volumes.
At a glance
- CVE
- CVE-2026-115377
- Product
- lxc incus
- CVSS
- 9.4 Critical
- Weakness
- CWE-59
- Exploited
- No known exploitation
According to the National Vulnerability Database, the issue carries a CVSS score of 9.4, classifying it as Critical. The weakness is categorized under CWE-59, which relates to improper link resolution before file access. This high severity rating reflects the potential for significant system damage.
Technical Details of the Exploit
Attackers can exploit this vulnerability by crafting specific rsync or btrfs receive streams that include malicious symbolic links. These crafted streams are designed to trick the migration process into following unintended paths within the host filesystem.
For example, an attacker might plant a symlink named rootfs that points directly to the host root directory. When the migration process processes this volume, it follows the link and writes files to the host root instead of the container volume.
This mechanism allows the attacker to write files as the root user on the host system. Such access grants full control over the host environment, leading to complete compromise of the underlying infrastructure.
Affected Versions
The vulnerability impacts multiple release branches of Incus. Systems running versions prior to 6.0.7 are affected by this arbitrary file write issue.
Additionally, the 6.1.0 branch is vulnerable in versions prior to 7.0.2. Users on these specific builds face the same risk of host file manipulation during migration operations.
The 7.1.0 branch is also impacted, with versions before 7.5.0 containing the flaw. Organizations using any of these affected versions should assess their exposure to untrusted migration sources.
What should you do?
Security teams should immediately audit their Incus deployments to identify affected versions. Checking the current version against the vulnerable ranges is the first step in determining risk.
If malicious migration sources are possible, restrict access to migration endpoints. Limiting who can initiate migrations reduces the attack surface for this specific vector.
Monitor logs for unusual file write activities during migration processes. Unexpected changes to host files can indicate an active exploitation attempt.
What to do and how to stay safe: Incus
- Verify your Incus version against the affected ranges listed in CVE-2026-115377
- Restrict migration sources to trusted and verified instances only
- Monitor host filesystems for unexpected file modifications during migrations
- Plan to upgrade to patched versions once the vendor provides an update
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-115377?
It is a critical arbitrary file write vulnerability in Incus that allows attackers to write host files via malicious migration sources.
Which Incus versions are affected?
Versions before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 are affected.
How severe is this vulnerability?
It is rated Critical with a CVSS score of 9.4, allowing full host compromise.
