CVE-2026-47753
Received Received - Intake

Denial of Service in Incus via Malicious Backup Upload

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateInstanceFromBackup` in `internal/server/storage/backend.go` contains a nil-pointer dereference that an authenticated user with permission to create instances in any project can trigger remotely by uploading a crafted backup tarball. The Incus daemon panics and the process crashes, causing denial of service to every project on that cluster member. This is a sibling of `GHSA-fwj8-62r8-8p8m`, `GHSA-r7w7-mmxr-47r9`, and `GHSA-x5r6-jr56-89pv` (all assigned 2026-05-04). Those patches added guards on adjacent fields of the same `backup/config.Config` struct; the `Volume` field on the instance-import path was missed. Version 7.1.0 contains an updated patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-47753
EUVD
EUVD-2026-63975

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lxc incus to 7.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-47753 is a vulnerability in Incus versions before 7.1.0 where an authenticated user with instance creation permissions can trigger a denial of service by uploading a crafted backup tarball. The issue occurs due to a nil-pointer dereference in the CreateInstanceFromBackup function, causing the Incus daemon to crash and halt all operations on the affected cluster member.

Detection Guidance

Detecting this vulnerability requires checking the Incus version and monitoring for crashes in the incusd process. Run 'incus version' to verify if your version is below 7.1.0. Check logs for daemon crashes or panics, particularly after backup import operations. Look for errors in /var/log/incusd.log or journalctl -u incusd for signs of nil-pointer dereferences.

Impact Analysis

This vulnerability allows an attacker to crash the Incus daemon, causing a denial of service for all projects on the affected cluster member. The impact persists until the process is manually restarted. The attack requires only authenticated access with basic instance creation permissions.

Mitigation Strategies

Upgrade Incus to version 7.1.0 or later immediately. If upgrading is not possible, restrict instance creation permissions to trusted users only. Disable backup import functionality if unused. Monitor the incusd process for crashes and restart it if it fails. Ensure all backups are validated before import.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47753. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart