CVE-2026-48752: Critical Incus Container Escape via Malicious Image Template Symlink

Vulnerability Overview

CVE-2026-48752 is a critical severity vulnerability (CVSS 9.9) in incusd, the daemon component of the Incus container and VM management platform. The root cause is improper external control of file names during image template processing (CWE-73). When incusd imports a container image or creates a container from one, it processes files within the image's templates/ directory without adequately validating symlink targets. A specially crafted image can embed a malicious symlink inside templates/ that resolves to an arbitrary path on the host filesystem, granting the attacker read or write access outside the container boundary.

The impact is severe: successful exploitation yields a container escape primitive with host takeover potential. An attacker who can supply a malicious image — whether through a compromised registry, a supply chain attack, or a social engineering vector — can read sensitive host files (credentials, keys, configuration) or overwrite critical binaries and configuration, leading to full host compromise.

Affected Software

• Package: github.com/lxc/incus/v7/cmd/incusd
• Ecosystem: Go
• Affected versions: all releases prior to 7.2.0
• Patched version: 7.2.0 (patch release pending confirmation)

Operators running any Incus version below 7.2.0 should treat their hosts as potentially vulnerable and prioritise remediation immediately.

Exploitation Status

A public proof-of-concept is available as of the disclosure date (2026-06-26). This significantly lowers the bar for exploitation — opportunistic attackers and red teams alike now have a reproducible path to trigger the symlink traversal. No confirmed in-the-wild exploitation or KEV listing was recorded at time of publication, but the public PoC and the critical CVSS score mean that active exploitation should be considered imminent. Defenders should not wait for KEV listing before acting.

How Our Detection Catches It

The df00tech detection package for CVE-2026-48752 ships coverage across seven SIEM platforms:

• Microsoft Sentinel (KQL) — correlates incusd process events with symlink resolution and unexpected host-path file access outside expected container namespaces.
• Splunk (SPL) — detects anomalous file operations spawned from the incusd daemon targeting host filesystem paths that should never appear in normal image import workflows.
• Elastic (EQL) — sequences image import events with follow-on file read/write events to host-sensitive directories, flagging the exploitation chain end-to-end.
• IBM QRadar (AQL) — queries flow and log data for incusd template processing events paired with out-of-namespace path traversal indicators.
• Sumo Logic — alert logic targeting incusd log messages and OS audit events that indicate symlink resolution to host paths during container creation.
• Google Chronicle (YARA-L) — rule matches on UDM events associating incusd process activity with host file modifications consistent with template symlink abuse.
• CrowdStrike (CQL) — sensor-level query detecting process lineage from incusd performing file operations on host paths inconsistent with sandboxed container execution.

The detection logic centres on two behavioural signals: (1) incusd resolving symlink targets that traverse outside the expected container image staging directory during import or instantiation, and (2) subsequent file I/O by incusd or its child processes against host-sensitive paths. Both signals are low-noise in normal Incus operations, making this a high-fidelity detection with minimal tuning required.

Recommended Actions

• Upgrade incusd to version 7.2.0 or later as the primary remediation.
• Until patched, restrict image imports to trusted, internally-verified sources and block access to public or untrusted image registries at the network level.
• Review audit logs for historical incusd template processing events against sensitive host paths.
• Enable the detections shipped in this package and alert on any hits immediately — given the public PoC, treat any trigger as high-priority.

Full detection queries, playbooks, and atomic test cases for CVE-2026-48752 are available on the CVE-2026-48752 detection page. Paid subscribers receive the complete purple team package including step-by-step simulation procedures and tuning guidance for each SIEM platform.