There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write
    exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This
    can lead to arbitrary command execution as root on the server. Version 7.2.0 patches the issue.
    (CVE-2026-48769)

  - Incus is a system container and virtual machine manager. Prior to version 7.1.0,
    `(*backend).CreateInstanceFromBackup` in `internal/server/storage/backend.go` contains a nil-pointer
    dereference that an authenticated user with permission to create instances in any project can trigger
    remotely by uploading a crafted backup tarball. The Incus daemon panics and the process crashes, causing
    denial of service to every project on that cluster member. This is a sibling of `GHSA-fwj8-62r8-8p8m`,
    `GHSA-r7w7-mmxr-47r9`, and `GHSA-x5r6-jr56-89pv` (all assigned 2026-05-04). Those patches added guards on
    adjacent fields of the same `backup/config.Config` struct; the `Volume` field on the instance-import path
    was missed. Version 7.1.0 contains an updated patch. (CVE-2026-47753)

  - Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image
    can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command
    execution. Version 7.2.0 fixes the issue. (CVE-2026-48749)

  - Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output`
    parameter of the `/instances/$name/exec` endpoint stores the output of the command in the `exec-output`
    directory of the instance. If `exec-output` is a symlink, file named `exec_UUID.stdout` and
    `exec_UUID.stderr` can be written to an arbitrary location where the `.stdout` file will contain arbitrary
    content. This behavior can be abused for arbitrary command execution. Version 7.2.0 contains a patch.
    (CVE-2026-48750)

  - Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore
    the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus
    server by abusing lowlevel hooks such as `raw.lxc` and `raw.qemu`. Version 7.2.0 patches the issue.
    (CVE-2026-48751)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Incus is a system container and virtual machine manager. Prior to version 7.1.0,
    `(*backend).createDependentVolumesFromBackup` in `internal/server/storage/backend.go` contains a cluster
    of unguarded pointer derefs on every dependent-volume entry's `VolumeSnapshots[i]`, `Volume`, and `Pool`
    sub-fields. An authenticated user with `can_create_instances` permission on any project can crash the
    `incusd` daemon by uploading an instance backup tarball whose `dependent_volumes[*]` block contains a nil
    snapshot pointer (or omits `volume:` / `pool:`). This is a sibling-field variant of the 2026-05-04 batch
    fix `d768f81c0a1d985f35ae56219519822b080bf5e3` ("Properly check dependent volumes on import"). That commit
    added `if disk == nil` at the top of the outer loop, but did not guard the four sub-pointer fields the
    loop body dereferences naked. Version 7.1.0 contains an updated patch. (CVE-2026-48754)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Incus is a system container and virtual machine manager. Prior to version 7.1.0,     `(*backend).createDependentVolumesFromBackup` in `internal/server/storage/backend.go` contains a cluster     of unguarded pointer derefs on every dependent-volume entry's `VolumeSnapshots[i]`, `Volume`, and `Pool`     sub-fields. An authenticated user with `can_create_instances` permission on any project can crash the     `incusd` daemon by uploading an instance backup tarball whose `dependent_volumes[*]` block contains a nil     snapshot pointer (or omits `volume:` / `pool:`). This is a sibling-field variant of the 2026-05-04 batch     fix `d768f81c0a1d985f35ae56219519822b080bf5e3` (Properly check dependent volumes on import). That commit     added `if disk == nil` at the top of the outer loop, but did not guard the four sub-pointer fields the     loop body dereferences naked. Version 7.1.0 contains an updated patch. (CVE-2026-48754)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
444651	Alpine: multiple incus packages: security update to 7.0.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	7/11/2026	8/24/2026	high
444651	Alpine: multiple incus packages: security update to 7.0.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	7/11/2026	8/24/2026	high
443996	SCA: security update for github.com/lxc/incus/v7/cmd/incusd (GHSA-4xg6-52mh-fpw8)	Tenable Cloud Security	SCA Checks	6/26/2026	8/24/2026	medium
443996	SCA: security update for github.com/lxc/incus/v7/cmd/incusd (GHSA-4xg6-52mh-fpw8)	Tenable Self-Hosted Container Security	SCA Checks	6/26/2026	8/24/2026	medium
317759	Linux Distros Unpatched Vulnerability : CVE-2026-48754	Nessus	Misc.	5/29/2026	8/24/2026	medium

Detections

Analytics

Plugins Search

high

high

medium

medium

medium