CVE-2026-48769 — Incus Arbitrary File Write via Trusted Image Hash (CVSS 9.9)

Vulnerability Overview

CVE-2026-48769 is a critical arbitrary file write vulnerability (CWE-20: Improper Input Validation) in the Incus container and VM manager. During image pull operations, the Incus daemon (incusd) fails to properly validate image hashes, allowing a malicious or compromised image source to write arbitrary files to the host filesystem. With a CVSS score of 9.9, successful exploitation can result in full host compromise, container escape, or persistent backdoors via overwritten system binaries or configuration files.

Affected Software

The vulnerability affects the Go module github.com/lxc/incus/v7/cmd/incusd in all Incus releases prior to version 7.2.0. Environments pulling images from untrusted or potentially compromised remote sources are at highest risk.

Exploitation Status

A public proof-of-concept (PoC) exploit is available as of disclosure on 26 June 2026. No patch has been released at time of writing. The combination of a near-perfect CVSS score, a weaponizable PoC, and the absence of a patch makes this a high-priority threat for any organisation running Incus in production. Defenders should treat this as actively exploitable and act immediately — restrict image sources, audit image pull operations, and monitor for anomalous file writes originating from incusd.

Detection Coverage

Our detection engineering team has shipped rules across seven SIEM platforms for CVE-2026-48769:

• Microsoft Sentinel (KQL) — correlates process events and file write activity attributed to incusd, flagging writes to sensitive paths (e.g. /etc, /usr/bin, /sbin) during image pull operations.
• Splunk (SPL) — searches endpoint and syslog telemetry for unexpected file creation events spawned from the Incus daemon process tree.
• Elastic (EQL) — uses event sequence logic to chain an Incus image pull network event with a subsequent privileged file write on the same host within a short time window.
• IBM QRadar (AQL) — queries flow and log source data for incusd process activity coinciding with file integrity events outside expected container storage paths.
• Sumo Logic — leverages log search to identify Incus daemon file write anomalies correlated with outbound image fetch requests.
• Google Chronicle (YARA-L) — rule matches UDM events where the principal process is incusd and the target file path falls outside sanctioned container image directories.
• CrowdStrike (CQL) — Falcon sensor process graph query detects file write syscalls from the incusd binary to host-level paths not associated with normal container image storage.

All rules are tuned to reduce noise from legitimate image operations while surfacing writes to high-value targets that indicate exploitation in progress.

Next Steps

Until a patch is available, prioritise restricting Incus image sources to verified, internal mirrors and enable file integrity monitoring on critical host paths. For full detection query logic, MITRE ATT&CK mapping, and purple team guidance, see the CVE-2026-48769 detection page.