{"id":"CVE-2026-115377","kind":"vulnerability","aliases":["CVE-2026-115377"],"related":[],"title":"Incus: malicious migration sources can write any host file as root","description":"Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by planting symlinks in transferred volumes. Attackers can craft rsync or btrfs receive streams with a symlink such as rootfs pointing to the host root, writing files as root for full host compromise.","summary":"Incus hands migration streams (copy, move, refresh, push, pull) to rsync, or to btrfs receive, which follow symlinks on the host. A malicious source, or any client allowed to create instances or custom volumes in a project, can plant a symlink such as rootfs pointing at / and write arbitrary files as root, which means full host compromise. VMs are also hit through root.img. All rsync-based storage drivers and optimized btrfs are affected. Optimized ZFS transfers are not. The symlink check added in 7.3 runs after the transfer, so it does not help. Releases before 7.3.0 also allow host file reads. It is not unauthenticated: it needs a low-privilege authenticated client or a malicious or compromised migration peer.","severity":"critical","cvss":9.9,"epss":0.00405,"exploited":false,"exploited_at":null,"products":[{"name":"incus","fixed":["6.0.7","7.0.2","7.5.0"],"affected":">= 0, < 6.0.7; >= 6.1.0, < 7.0.2; >= 7.1.0, < 7.5.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["btrfs","incus","infrastructure","linux","migration","rsync","self-hosted"],"not_affected_if":["incus-not-installed","no-untrusted-clients","no-untrusted-migration-sources","zfs-only-optimized-transfers"],"how_to_check":"Run 'incus version' on every Incus server, the client output also shows the server version. You are exposed if it is below 6.0.7 on the 6.0 LTS line, 6.1 to 7.0.1, or 7.1 to 7.4.x. Then check who can create instances or volumes: 'incus project list', 'incus config trust list', and 'incus remote list' and 'incus cluster list' for migration peers.","fix":"Upgrade to Incus 6.0.7 or later (6.0 line), 7.0.2 or later (6.1 to 7.0 line), or 7.5.0 or later (7.1 line). Workaround from the vendor: only allow trusted clients to create instances and custom volumes, and only migrate from trusted servers.","status":"open","published_at":"2026-10-22T19:17:44+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-23T22:32:15+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:32:15Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Incus to 6.0.7 or later on the 6.0 branch, 7.0.2 or later on the 6.1 and 7.0 line, or 7.5.0 or later on the 7.1 line.","reach":"network","title":"Incus: malicious migration sources can write any host file as root","impact":"high","summary":"Incus is a container and virtual machine manager. A malicious migration source can plant symlinks in transferred volumes so its rsync or btrfs receive streams write files on the host, including as root.","category":"infrastructure","who_cares":["incus","self-hosted","linux"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Attacker writes root-owned files on host, full host compromise","analyst_note":"Check the NVD entry or Incus advisory for whether migration receive requires API authentication and whether the flaw is reachable under default configuration.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-untrusted-migration-sources","incus-not-installed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000957,"input_tokens":2985,"output_tokens":1317,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the NVD entry or Incus advisory for whether migration receive requires API authentication and whether the flaw is reachable under default configuration.","search":"'-115377':14A,17A '-2026':13A,16A '6.0.7':151C '6.1.0':152C '7.0.2':154C '7.1.0':156C '7.3':112B '7.3.0':124B '7.5.0':158C 'add':110B 'affect':101B 'allow':55B,126B,166C 'also':87B,125B 'arbitrari':76B,161C 'attack':180C 'authent':140B 'base':94B 'btrfs':19B,41B,99B,185C 'check':109B 'client':54B,141B 'compromis':84B,146B,206C 'contain':159C 'copi':32B 'craft':182C 'creat':57B 'custom':60B 'cve':12A,15A 'driver':96B 'file':9A,77B,128B,162C,173C,200C 'follow':44B 'full':82B,204C 'hand':29B 'help':121B 'hit':88B 'host':8A,27B,48B,83B,127B,172C,197C,205C 'incus':1A,18A,20B,28B,149C 'infrastructur':21B 'instanc':58B 'linux':22B 'low':138B 'low-privileg':137B 'malici':2A,50B,144B,167C 'mean':81B 'migrat':3A,23B,30B,147B,168C 'move':33B 'need':135B 'optim':98B,102B 'peer':148B 'plant':66B,175C 'point':72B,194C 'privileg':139B 'project':64B 'pull':36B 'push':35B 'read':129B 'receiv':42B,186C 'refresh':34B 'releas':122B 'root':11A,79B,198C,202C 'root.img':90B 'rootf':71B,193C 'rsync':24B,38B,93B,183C 'rsync-bas':92B 'run':113B 'self':26B 'self-host':25B 'sourc':4A,51B,169C 'storag':95B 'stream':31B,187C 'symlink':45B,68B,108B,176C,190C 'transfer':104B,116B,178C 'unauthent':133B 'vms':85B 'volum':61B,179C 'vulner':164C 'write':6A,75B,163C,171C,199C 'zfs':103B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115377","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115377","severity":null,"published_at":"2026-10-22T19:17:44+00:00","modified_at":"2026-10-23T17:06:36+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115377:299","url":null,"severity":null,"published_at":"2026-10-23T22:47:27+00:00","modified_at":"2026-10-23T22:47:27+00:00","first_seen_at":"2026-10-23T22:47:27+00:00","fetched_at":"2026-10-23T22:47:27+00:00","note":"Read upstream GHSA-579w-c4rw-c8q3 (stgraber) and CVE record. Needs API auth with low privileges (create instance or volume in a project), or a server the target is told to migrate from. No public PoC or exploitation found. I did not search social posts. GHSA lists only 7.5.0 as patched; 6.0.7 and 7.0.2 come from the CVE record."},{"source":"epss","external_id":"CVE-2026-115377","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115377","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1601,"url":"https://github.com/lxc/incus/security/advisories/GHSA-579w-c4rw-c8q3","title":"Incus GHSA-579w-c4rw-c8q3: Arbitrary file write on host via symlink in migration stream","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1602,"url":"https://linuxcontainers.org/incus/news/","title":"Linux Containers - Incus news (security fixes release)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}