CVE-2026-48751

CVSS 9.9 (critical) · published 2026-08-21

Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as `raw.lxc` and `raw.qemu`. Version 7.2.0 patches the issue.

Weakness: CWE-862

Source: NVD CVE-2026-48751

References

• https://github.com/canonical/lxd/security/advisories/GHSA-47w9-6r3f-938g
• https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv
• https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.