Executive Summary

CVE-2026-41685 is a moderate severity vulnerability in Incus versions prior to 7.0.0 that allows authenticated users to exhaust the disk space on the host system by uploading arbitrarily large amounts of data.

The issue arises because the Incus daemon streams HTTP request bodies directly into temporary files without enforcing size limits, enabling attackers to fill up storage until the system fails or crashes.

Vulnerable endpoints include instance backup imports, storage bucket imports, storage volume imports, and ISO uploads, all of which write data to disk before validation.

While users with configured storage volumes (storage.images_volume and storage.backups_volume) mitigate some risk, the default behavior on IncusOS remains exposed.

The vulnerability was patched in version 7.0.0 by implementing request size limits before data is written to disk.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing authenticated users to upload large amounts of data that exhaust the disk space on the host system.

When disk space is exhausted, the Incus server and potentially the entire host system can become unavailable or crash, leading to denial of service.

Users who do not use storage.images_volume or storage.backups_volume are more exposed, as uploads are stored directly on the host filesystem.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unusually large or sustained uploads to the Incus server, especially through endpoints related to instance backup imports, storage bucket imports, storage volume imports, and ISO uploads.

Since the issue involves disk space exhaustion caused by large uploads, checking disk usage and identifying processes or connections that are uploading large amounts of data can help detect exploitation attempts.

• Use commands like `df -h` to monitor disk space usage on the host system.
• Use `lsof | grep /tmp` or similar to identify large temporary files being created by the Incus daemon.
• Monitor network connections with `netstat -anp | grep <incus_process>` or `ss -tp` to identify active uploads to the Incus server.
• Use system monitoring tools to track sustained high network upload activity from authenticated users.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the Incus server to version 7.0.0 or later, where this vulnerability has been patched.

Until the upgrade can be performed, consider configuring storage.images_volume and storage.backups_volume to store large uploads on separate volumes rather than the host filesystem, as this reduces the risk of exhausting the host disk space.

Additionally, monitor disk usage closely and restrict authenticated user upload sizes if possible.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0