There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write
    exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This
    can lead to arbitrary command execution as root on the server. Version 7.2.0 patches the issue.
    (CVE-2026-48769)

  - Incus is a system container and virtual machine manager. Prior to version 7.1.0,
    `(*backend).CreateInstanceFromBackup` in `internal/server/storage/backend.go` contains a nil-pointer
    dereference that an authenticated user with permission to create instances in any project can trigger
    remotely by uploading a crafted backup tarball. The Incus daemon panics and the process crashes, causing
    denial of service to every project on that cluster member. This is a sibling of `GHSA-fwj8-62r8-8p8m`,
    `GHSA-r7w7-mmxr-47r9`, and `GHSA-x5r6-jr56-89pv` (all assigned 2026-05-04). Those patches added guards on
    adjacent fields of the same `backup/config.Config` struct; the `Volume` field on the instance-import path
    was missed. Version 7.1.0 contains an updated patch. (CVE-2026-47753)

  - Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image
    can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command
    execution. Version 7.2.0 fixes the issue. (CVE-2026-48749)

  - Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output`
    parameter of the `/instances/$name/exec` endpoint stores the output of the command in the `exec-output`
    directory of the instance. If `exec-output` is a symlink, file named `exec_UUID.stdout` and
    `exec_UUID.stderr` can be written to an arbitrary location where the `.stdout` file will contain arbitrary
    content. This behavior can be abused for arbitrary command execution. Version 7.2.0 contains a patch.
    (CVE-2026-48750)

  - Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore
    the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus
    server by abusing lowlevel hooks such as `raw.lxc` and `raw.qemu`. Version 7.2.0 patches the issue.
    (CVE-2026-48751)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Incus is a system container and virtual machine manager. Prior to version 7.1.0,
    `(*backend).CreateInstanceFromBackup` in `internal/server/storage/backend.go` contains a nil-pointer
    dereference that an authenticated user with permission to create instances in any project can trigger
    remotely by uploading a crafted backup tarball. The Incus daemon panics and the process crashes, causing
    denial of service to every project on that cluster member. This is a sibling of `GHSA-fwj8-62r8-8p8m`,
    `GHSA-r7w7-mmxr-47r9`, and `GHSA-x5r6-jr56-89pv` (all assigned 2026-05-04). Those patches added guards on
    adjacent fields of the same `backup/config.Config` struct; the `Volume` field on the instance-import path
    was missed. Version 7.1.0 contains an updated patch. (CVE-2026-47753)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Incus is a system container and virtual machine manager. Prior to version 7.1.0,     `(*backend).CreateInstanceFromBackup` in `internal/server/storage/backend.go` contains a nil-pointer     dereference that an authenticated user with permission to create instances in any project can trigger     remotely by uploading a crafted backup tarball. The Incus daemon panics and the process crashes, causing     denial of service to every project on that cluster member. This is a sibling of `GHSA-fwj8-62r8-8p8m`,     `GHSA-r7w7-mmxr-47r9`, and `GHSA-x5r6-jr56-89pv` (all assigned 2026-05-04). Those patches added guards on     adjacent fields of the same `backup/config.Config` struct; the `Volume` field on the instance-import path     was missed. Version 7.1.0 contains an updated patch. (CVE-2026-47753)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
444651	Alpine: multiple incus packages: security update to 7.0.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	7/11/2026	8/24/2026	high
444651	Alpine: multiple incus packages: security update to 7.0.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	7/11/2026	8/24/2026	high
443062	SCA: security update for github.com/lxc/incus/v7 (GHSA-8g7m-96c8-8wwc)	Tenable Self-Hosted Container Security	SCA Checks	6/11/2026	8/24/2026	high
443062	SCA: security update for github.com/lxc/incus/v7 (GHSA-8g7m-96c8-8wwc)	Tenable Cloud Security	SCA Checks	6/11/2026	8/24/2026	high
317764	Linux Distros Unpatched Vulnerability : CVE-2026-47753	Nessus	Misc.	5/29/2026	8/24/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high