CVE-2026-48750: Incus exec-output Symlink Race Enables Container Escape and Full Host Compromise

Vulnerability Overview

CVE-2026-48750 is a critical arbitrary file write vulnerability (CVSS 9.9) rooted in a symlink-following weakness (CWE-73: External Control of File Name or Path) in the Incus container and VM manager daemon, incusd. A crafted container image can place a symlink at the path used by Incus to write exec-output — the file that captures command execution results from inside a container. Because incusd follows that symlink without validation, the daemon writes attacker-controlled content to an arbitrary location on the host filesystem with the privileges of the daemon process. This is a textbook container escape primitive: an adversary who can influence a container image or its filesystem can pivot to full host compromise.

Affected Software

The vulnerability affects the Go package github.com/lxc/incus/v7/cmd/incusd — the server-side daemon component of the Incus project (the community fork of LXD). All versions prior to 7.2.0 are vulnerable. No patch date has been published at time of writing; operators should monitor the upstream repository and apply 7.2.0 or later immediately upon availability.

Exploitation Status

A public proof-of-concept is available. This materially compresses the window between disclosure and weaponization. While no in-the-wild exploitation has been confirmed, the combination of a CVSS 9.9 score, a straightforward symlink primitive, and a live PoC means defenders should treat this as imminently exploitable. Any environment running Incus for multi-tenant workloads, CI pipelines, or ephemeral container execution is at elevated risk — the attack surface is any party who can provide or mutate a container image.

Detection Coverage

Our detection targets the behavioral chain that makes this vulnerability exploitable at runtime, rather than relying solely on version signatures. We ship rules across seven SIEM platforms:

• Microsoft Sentinel (KQL) — correlates incusd file-write events against paths outside expected container storage roots, flagging writes that resolve through a symlink chain originating inside a container filesystem.
• Splunk (SPL) — hunts for incusd process activity writing to sensitive host paths (/etc, /root, cron directories, SSH authorized_keys, systemd unit paths) with sourcetype enrichment from auditd or Sysmon for Linux.
• Elastic (EQL) — uses sequence detection to pair a symlink-creation event inside a container mount with a subsequent host-side file-write by the daemon process, reducing false positives from benign exec-output usage.
• IBM QRadar (AQL) — alerts on incusd file events where the resolved write path does not share the container's overlay or zfs dataset prefix.
• Sumo Logic (CSE) — rule fires on host filesystem modifications attributed to the Incus daemon outside of configured storage pools.
• Chronicle (YARA-L) — detects the symlink-follow pattern using UDM file-creation events correlated with the incusd principal and anomalous target paths.
• CrowdStrike (CQL / Falcon) — targets the process lineage where incusd is the actor writing to host-sensitive paths, leveraging kernel telemetry unavailable to log-only detections.

Detection logic keys on the symlink-follow behavior and the resulting out-of-bounds write path rather than static version checks alone, providing coverage even where asset inventory is incomplete.

Recommended Actions

• Upgrade incusd to version 7.2.0 or later as the primary remediation.
• Until patched, restrict who can supply container images to trusted, signed sources only.
• Enable auditd rules or Sysmon for Linux to generate the file-write telemetry our detections depend on.
• Review exec-output path configuration and consider disabling the feature if not operationally required.

Full detection queries for all seven platforms — along with MITRE ATT&CK mapping, atomic test cases, and purple team playbooks — are available on the CVE-2026-48750 detection page.