External risk intelligence

Incus Snapshot Vulnerability Allows Command Execution

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-48751

Incus is a system container and virtual machine manager typically deployed within internal infrastructure, data centers, or restricted management environments. While it may be reachable over a network, it is rarely exposed directly to the public internet, and access is generally protected by internal network controls or administrative authentication requirements.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in Incus, a system for managing containers and virtual machines, that could allow for arbitrary command execution on the server if a specific setting is not properly configured. This issue impacts systems prior to version 7.2.0. The main concern is confirming if your environment uses this technology and is exposed.

Command execution flaw in container management.
Matters if you use Incus for infrastructure.
Confirm Incus use and potential exposure.

Attack Path

How an attacker could exploit the issue

A user with low-level administrative access to Incus could potentially execute arbitrary commands on the server. This is possible because, in certain versions, the snapshot feature incorrectly ignores a security setting, allowing attackers to leverage hooks like `raw.lxc` or `raw.qemu` to gain control. The vulnerability can lead to a complete compromise of the Incus server.

Requires low-level administrative access.
Abuses snapshot feature and hooks.
Allows arbitrary command execution on server.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Incus, a system container and virtual machine manager, could allow an unauthenticated attacker with low privileges to execute arbitrary commands on the Incus server when specific low-level hooks are abused. This could affect the integrity and availability of the Incus server and any managed instances.

Arbitrary command execution on the Incus server.
Abusing low-level hooks like `raw.lxc` or `raw.qemu`.
Compromise of server integrity and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Incus platform team or the infrastructure team managing the container and virtual machine environment is likely responsible for addressing this vulnerability. The first practical step is to identify all Incus servers, determine their network reachability and business criticality, and locate the accountable owner before planning remediation.

Incus platform or infrastructure teams own remediation.
Verify Incus server reachability and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Incus and how is it used?

Incus is an open-source system container and virtual machine manager. It provides a unified interface for system administrators to provision, manage, and scale Linux containers and full virtual machines across infrastructure, similar to how one might manage cloud instances.

What is the vulnerability in CVE-2026-48751?

This vulnerability is classified as Improper Authorization (CWE-862). It occurs because Incus fails to enforce the 'restricted.containers.lowlevel=block' setting when taking instance snapshots. This oversight allows an authorized user to bypass intended restrictions and execute arbitrary commands on the underlying server using low-level configuration hooks.

How can an attacker trigger this vulnerability?

An attacker needs low-level administrative access to the Incus environment to exploit this flaw. The vulnerability is triggered by creating or interacting with snapshots that misuse hooks like 'raw.lxc' or 'raw.qemu'. Simply using the container management software for standard operations without attempting to bypass restricted settings will not trigger the bug.

Is my Incus server at risk from this vulnerability?

According to Halo Surface Signal, Incus is typically deployed within internal data centers or restricted management zones rather than directly on the public internet. While you should check if your version is prior to 7.2.0, the actual risk depends on your specific network controls and whether you have untrusted users with the required low-level access.

What are the first steps to address this issue?

Start by identifying all Incus servers currently running in your environment to determine their version. If any servers are running versions older than 7.2.0, document their business criticality and network reachability. Coordinate with your infrastructure team to prioritize updating these instances to version 7.2.0, which contains the official patch for this vulnerability.

References

github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.