Incus Symlink Arbitrary File Read/Write via metadata.yaml

Executive Summary

CVE-2026-63343 is a critical vulnerability in Incus affecting versions prior to 7.3.0. It allows authenticated users to read or overwrite any file on the host system as root by exploiting a symlink in a malicious image's metadata.yaml file. The vulnerability bypasses prior patches for similar issues because metadata.yaml was not included in those fixes.

Useful 0 Not Useful 0

Detection Guidance

Check Incus version with 'incus version' to confirm if it is below 7.3.0. Inspect images for malicious metadata.yaml symlinks by examining image contents before deployment. Monitor for unauthorized file changes on the host system, especially in directories accessible via Incus.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated Incus user to gain root access on the host system. Attackers can read sensitive files like configuration files or overwrite critical system files, leading to potential data breaches, system compromise, or denial of service. The exploit does not require privileged containers or running workloads.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can severely impact compliance with GDPR, HIPAA, and other regulations by enabling unauthorized access to sensitive data (confidentiality breach) and potential modification or deletion of critical files (integrity and availability breach). Organizations using vulnerable Incus versions may face regulatory penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Incus to version 7.3.0 or later immediately. Remove or quarantine any untrusted images. Restrict authenticated user access to Incus until patched. Review and audit existing images for suspicious metadata.yaml files.

Useful 0 Not Useful 0