Vulnerability · Published Jun 25, 2025 · Assigned by GitHub_M

CVE-2025-52890Incus vulnerable to antispoofing nftables firewall rule bypass on bridge networks with ACLs

High 8.1

In plain English

A high-severity incorrect authorization in incus from lxc. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.2%top 86.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus versions 6.12 and 6.13generates nftables rules that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to ARP spoofing on the bridge and to fully spoof another VM/container on the same bridge. Commit 254dfd2483ab8de39b47c2258b7f1cf0759231c8 contains a patch for the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.23	incus-feature	6.14.0-r0	ALPINE-CVE-2025-52890
Alpine:v3.24	incus-feature	6.14.0-r0	ALPINE-CVE-2025-52890
Go	github.com/lxc/incus	no fix listed	GO-2025-3782
Go	github.com/lxc/incus/v6	6.14.0	GHSA-p7fw-vjjm-2rwp
Go	github.com/lxc/incus/v6	6.14.0	GO-2025-3782
Ubuntu:25.10	incus	no fix listed	UBUNTU-CVE-2025-52890
Ubuntu:26.10	incus	no fix listed	UBUNTU-CVE-2025-52890

Affected products (as reported)

Vendor	Product	Versions
lxc	incus	>= 6.12, <= 6.13

Weakness: CWE-863 · Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H

References

https://github.com/lxc/incus/security/advisories/GHSA-p7fw-vjjm-2rwp x_refsource_CONFIRM
https://github.com/lxc/incus/commit/254dfd2483ab8de39b47c2258b7f1cf0759231c8 x_refsource_MISC