CVE-2026-48749: Incus Container Escape via Rootfs Symlink in Malicious Image (CVSS 9.9)

Vulnerability Overview

CVE-2026-48749 is a critical container escape vulnerability in Incus, the open-source system container and virtual machine manager maintained under the LXC project. The flaw is classified as CWE-73 (External Control of File Name or Path) and stems from insufficient validation of symlinks within the rootfs/ directory of container images during import or instantiation.

When Incus processes a container image, it unpacks the rootfs/ layer onto the host filesystem. If that layer contains symlinks whose targets resolve to arbitrary host paths — rather than paths within the container root — the daemon will follow them without restriction. An attacker who can deliver a crafted image to a vulnerable Incus daemon can exploit this to read or overwrite arbitrary files on the underlying host. In practice this is a full container escape primitive: writing to /etc/cron.d/, /root/.ssh/authorized_keys, or replacing binaries in /usr/bin/ are straightforward escalation paths leading to complete host compromise.

Affected Software

• Product: github.com/lxc/incus/v7/cmd/incusd
• Vendor ecosystem: Go (LXC project)
• Vulnerable versions: all releases prior to 7.2.0
• Patch available: No patch date recorded at time of publication — operators should monitor the upstream repository for the 7.2.0 release.

Exploitation Status

A public proof-of-concept (PoC) is available as of the disclosure date (2026-06-26). With a CVSS base score of 9.9 and a working PoC in the wild, the barrier to exploitation is low. Any environment where untrusted or third-party images can be imported into an unpatched Incus daemon should be treated as actively at risk. This vulnerability has not yet appeared on CISA's Known Exploited Vulnerabilities (KEV) catalog at time of writing, but the combination of critical severity and public PoC warrants immediate defensive action.

Detection Coverage

The df00tech detection package for CVE-2026-48749 ships query logic tuned for seven SIEM platforms: Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Google Chronicle (YARA-L), and CrowdStrike (CQL).

Detection logic focuses on the following observable behaviors produced during exploitation:

• Incus daemon (incusd) process performing file operations — opens, reads, or writes — on host paths outside expected container storage roots, particularly paths such as /etc/, /root/, /home/, or /usr/ via a symlink traversal chain originating in a container image unpack operation.
• Creation or modification of sensitive host files where the initiating process lineage traces back to incusd or its image import subsystem.
• Anomalous image import events followed immediately by file-system mutations in high-value host directories within a short time window.

The KQL and SPL variants leverage process and file-event telemetry (Sysmon/Linux audit or equivalent EDR). The Elastic EQL rule uses sequence matching to correlate image import activity with subsequent host-path writes. Chronicle YARA-L and CrowdStrike CQL rules operate on endpoint telemetry ingested into those platforms natively.

Defensive Recommendations

• Upgrade Incus to version 7.2.0 or later as soon as a patched release is available.
• Restrict image imports to trusted, signed sources and enforce image provenance controls.
• Run Incus with a restrictive AppArmor or SELinux policy to limit the daemon's ability to follow symlinks outside defined storage pools.
• Enable file integrity monitoring on sensitive host directories as a compensating control.

Full Detection

The complete detection queries for all seven SIEM platforms, including MITRE ATT&CK mapping, triage guidance, and atomic test cases, are available on the CVE-2026-48749 detection page. Paid subscribers receive the full playbook and purple team test procedures.