Log in Start free

Vulnerability · Published Aug 21, 2026 · Assigned by GitHub_M

CVE-2026-48755Incus has an argument injection in backup compression algorithm leading to AFW and ACE

Critical 9.9

In plain English

A critical-severity improper input validation in lxd from canonical. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.9Critical
Exploit odds (30 days)0.8%top 43.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.24incus7.0.1-r0ALPINE-CVE-2026-48755
Debian:13incus6.0.4-2+deb13u8DEBIAN-CVE-2026-48755
Debian:14incus7.0.0-5DEBIAN-CVE-2026-48755
Debian:12lxdno fix listedDEBIAN-CVE-2026-48755
Debian:13lxd5.0.2+git20231211.1364ae4-9+deb13u7DEBIAN-CVE-2026-48755
Gogithub.com/lxc/incusno fix listedGO-2026-5808
Gogithub.com/lxc/incus/v6no fix listedGO-2026-5808
Gogithub.com/lxc/incus/v77.2.0GO-2026-5808
Gogithub.com/lxc/incus/v7/cmd/incusd7.2.0GHSA-v6mj-8pf4-hhw4
Ubuntu:25.10incusno fix listedUBUNTU-CVE-2026-48755
Ubuntu:26.10incusno fix listedUBUNTU-CVE-2026-48755

Affected products (as reported)

VendorProductVersions
lxc incus < 7.2.0
canonical lxd >= 4.0.0, < 4.0.11>= 5.0.0, < 5.0.7>= 5.1.0, < 5.21.5>= 6.0.0, < 6.9.0

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References