CVE-2026-48755: Argument Injection in Incus Backup Compression Leads to Arbitrary Code Execution

Vulnerability Overview

CVE-2026-48755 is an argument injection vulnerability (CWE-20: Improper Input Validation) in the Incus container and VM manager. The root cause lies in the backup compression algorithm selection logic within the incusd daemon: user-controlled input specifying the compression algorithm is passed to the underlying compression utility without adequate sanitization. This allows an attacker to inject shell metacharacters or additional command-line arguments into the compression command invoked by incusd.

The impact is severe — the vulnerability enables arbitrary file write (AFW) and arbitrary code execution (ACE) at the privilege level of the incusd process, which typically runs with elevated host privileges. In containerized environments, this creates a direct path to container escape and full host compromise. The vulnerability carries a CVSS score of 9.9.

Affected Software

• Product: github.com/lxc/incus/v7/cmd/incusd
• Affected versions: All releases prior to 7.2.0
• Vendor ecosystem: Go (github.com/lxc/incus)

Organizations running Incus for container or virtual machine orchestration on versions earlier than 7.2.0 are exposed. The incusd daemon is the privileged backend service; any system where it is reachable via the Incus API is at risk.

Exploitation Status

A public proof-of-concept (PoC) exploit is available as of disclosure on 2026-06-26. The vulnerability is not yet patched — no patchedDate has been recorded at time of writing. The combination of a public PoC, a critical CVSS score, and an unpatched state means defenders should treat this as actively exploitable. Any environment exposing the Incus API — even on internal networks — must be prioritized for immediate mitigation.

An attacker requires API access to the Incus daemon to trigger the vulnerability. Depending on your deployment posture, this may mean a low-privilege authenticated user, a compromised workload with API socket access, or a misconfigured network-exposed daemon endpoint.

Detection Coverage

Our detection for CVE-2026-48755 ships across seven SIEM platforms, giving defenders broad coverage regardless of their logging stack:

• Microsoft Sentinel (KQL) — Correlates process creation events for compression utilities (gzip, bzip2, xz, zstd, etc.) spawned under the incusd parent process, flagging argument patterns consistent with injection payloads.
• Splunk (SPL) — Searches process telemetry for incusd child processes invoking compression binaries with anomalous argument sequences or shell metacharacters.
• Elastic (EQL) — Sequence detection linking incusd API activity to suspicious child process spawns, with field extraction for injected argument fragments.
• IBM QRadar (AQL) — AQL rule targeting incusd process lineage and compression command invocations carrying unexpected argument tokens.
• Sumo Logic — Log search query identifying compression utility executions descending from incusd with out-of-pattern argument structures.
• Google Chronicle (YARA-L) — YARA-L rule correlating Incus daemon events with child process launches characteristic of argument injection exploitation.
• CrowdStrike (CQL) — Falcon query targeting process tree anomalies rooted at incusd invoking system compression utilities with injected arguments.

The detection logic centers on process lineage: legitimate Incus backup compression operations spawn compression utilities with predictable, well-formed argument sets. Exploitation introduces unexpected tokens — path traversal sequences, additional flags, or shell operators — that stand out clearly in process telemetry. Defenders should also monitor for unexpected file creation events in sensitive host paths following incusd compression invocations.

Recommendations

• Upgrade Incus to version 7.2.0 or later as soon as a patch is released.
• Restrict API access to the Incus daemon to the minimum required set of principals.
• Audit Incus API socket exposure — ensure it is not reachable from untrusted workloads or network segments.
• Deploy the detection rules below and alert on any hits immediately given the public PoC status.

Full detection queries for all seven SIEM platforms — including KQL, SPL, Elastic EQL, QRadar AQL, Sumo Logic, Chronicle YARA-L, and CrowdStrike CQL — are available on the CVE-2026-48755 detection page. Free-tier users can access the queries directly; purple team playbooks and atomic test cases are available to subscribers.