CVE-2026-48751
Received Received - Intake

Privilege Escalation in Incus via Snapshot Hooks

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as `raw.lxc` and `raw.qemu`. Version 7.2.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-48751
EUVD
EUVD-2026-63978

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
canonical incus to 7.2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-48751 is a critical vulnerability in Incus, a container and virtual machine manager. It allows bypassing security restrictions by ignoring the `restricted.containers.lowlevel=block` setting. Attackers can exploit low-level hooks like `raw.lxc` and `raw.qemu` to execute arbitrary commands on the host with root privileges. The issue affects versions before 7.2.0.

Detection Guidance

Check Incus version with 'incus version' to see if it is below 7.2.0. Inspect instances for suspicious snapshots or hooks like 'raw.lxc' or 'raw.qemu' in configuration. Review project restrictions for misconfigurations.

Impact Analysis

This vulnerability allows attackers to bypass project restrictions and execute arbitrary commands on the Incus server with root privileges. If exploited, it could lead to full host compromise, unauthorized access, and potential data breaches or system takeover.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements under GDPR and HIPAA. It may result in data exposure, lack of access controls, and failure to maintain system integrity, potentially leading to legal penalties and reputational damage.

Mitigation Strategies

Upgrade Incus to version 7.2.0 or later immediately. Disable or audit low-level hooks such as 'raw.lxc' and 'raw.qemu'. Review and enforce project restrictions, particularly 'restricted.containers.lowlevel=block'.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48751. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart