Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.19.0 affects any Incus user in an environment where an unprivileged user may have root access to a container with an attached custom storage volume that has the `security.shifted` property set to `true` as well as access to the host as an unprivileged user. The most common case for this would be systems using `incus-user` with the less privileged `incus` group to provide unprivileged users with an isolated restricted access to Incus. Such users may be able to create a custom storage volume with the necessary property (depending on kernel and filesystem support) and can then write a setuid binary from within the container which can be executed as an unprivileged user on the host to gain root privileges. A patch for this issue is expected in versions 6.0.6 and 6.19.0. As a workaround, permissions can be manually restricted until a patched version of Incus is deployed.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.19.0
    affects any Incus user in an environment where an unprivileged user may have root access to a container
    with an attached custom storage volume that has the `security.shifted` property set to `true` as well as
    access to the host as an unprivileged user. The most common case for this would be systems using `incus-
    user` with the less privileged `incus` group to provide unprivileged users with an isolated restricted
    access to Incus. Such users may be able to create a custom storage volume with the necessary property
    (depending on kernel and filesystem support) and can then write a setuid binary from within the container
    which can be executed as an unprivileged user on the host to gain root privileges. A patch for this issue
    is expected in versions 6.0.6 and 6.19.0. As a workaround, permissions can be manually restricted until a
    patched version of Incus is deployed. (CVE-2025-64507)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker
    to create and start container instances without user consent via crafted HTML form submissions exploiting
    client certificate authentication. (CVE-2025-54286)

  - Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker
    with instance configuration permissions to read arbitrary files on the host system via specially crafted
    snapshot pattern templates using the Pongo2 template engine. (CVE-2025-54287)

  - Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms
    allows attackers with root privileges within any container to impersonate other containers and obtain
    their metadata, configuration, and device information via spoofed process names in the command line.
    (CVE-2025-54288)

  - Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with
    read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket
    connection hijacking format (CVE-2025-54289)

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-6057 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6057-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     November 13, 2025                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : lxd     CVE ID         : CVE-2025-64507

    It was discovered that LXD, a system container and virtual machine     manager, is prone to a local privilege escalation vulnerability if     unprivileged users are allowed to access LXD through lxd-user.

    For the oldstable distribution (bookworm), this problem has been fixed     in version 5.0.2-5+deb12u2.

    We recommend that you upgrade your lxd packages.

    For the detailed security status of lxd please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/lxd

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6051 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6051-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     November 10, 2025                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : incus     CVE ID         : CVE-2025-64507

    It was discovered that Incus, a system container and virtual machine     manager, is prone to a local privilege escalation vulnerability     unprivileged users are allowed access to Incus through incus-user.

    For the stable distribution (trixie), this problem has been fixed in     version 6.0.4-2+deb13u2.

    We recommend that you upgrade your incus packages.

    For the detailed security status of incus please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/incus

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.19.0     affects any Incus user in an environment where an unprivileged user may have root access to a container     with an attached custom storage volume that has the `security.shifted` property set to `true` as well as     access to the host as an unprivileged user. The most common case for this would be systems using `incus-     user` with the less privileged `incus` group to provide unprivileged users with an isolated restricted     access to Incus. Such users may be able to create a custom storage volume with the necessary property     (depending on kernel and filesystem support) and can then write a setuid binary from within the container     which can be executed as an unprivileged user on the host to gain root privileges. A patch for this issue     is expected in versions 6.0.6 and 6.19.0. As a workaround, permissions can be manually restricted until a     patched version of Incus is deployed. (CVE-2025-64507)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
439451	SCA: security update for github.com/lxc/incus/v6 (GHSA-56mx-8g9f-5crf)	Tenable Cloud Security	SCA Checks	high
439451	SCA: security update for github.com/lxc/incus/v6 (GHSA-56mx-8g9f-5crf)	Tenable Self-Hosted Container Security	SCA Checks	high
438878	Alpine: multiple incus packages: security update to 6.0.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
438878	Alpine: multiple incus packages: security update to 6.0.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
275377	Debian dsa-6057 : lxd - security update	Nessus	Debian Local Security Checks	high
274638	Debian dsa-6051 : golang-github-lxc-incus-dev - security update	Nessus	Debian Local Security Checks	high
274626	Linux Distros Unpatched Vulnerability : CVE-2025-64507	Nessus	Misc.	high

Detections

Analytics

CVE-2025-64507

high

Tenable Plugins

high

high

critical

critical

high

high

high