---
id: "CVE-2026-115377"
kind: "vulnerability"
aliases: ["CVE-2026-115377"]
title: "Incus: malicious migration sources can write any host file as root"
severity: "critical"
cvss: 9.9
epss: 0.00405
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "incus", "fixed": ["6.0.7", "7.0.2", "7.5.0"], "affected": ">= 0, < 6.0.7; >= 6.1.0, < 7.0.2; >= 7.1.0, < 7.5.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["btrfs", "incus", "infrastructure", "linux", "migration", "rsync", "self-hosted"]
not_affected_if: ["incus-not-installed", "no-untrusted-clients", "no-untrusted-migration-sources", "zfs-only-optimized-transfers"]
published_at: "2026-10-22T19:17:44+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115377", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:47:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115377", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Incus: malicious migration sources can write any host file as root

Incus hands migration streams (copy, move, refresh, push, pull) to rsync, or to btrfs receive, which follow symlinks on the host. A malicious source, or any client allowed to create instances or custom volumes in a project, can plant a symlink such as rootfs pointing at / and write arbitrary files as root, which means full host compromise. VMs are also hit through root.img. All rsync-based storage drivers and optimized btrfs are affected. Optimized ZFS transfers are not. The symlink check added in 7.3 runs after the transfer, so it does not help. Releases before 7.3.0 also allow host file reads. It is not unauthenticated: it needs a low-privilege authenticated client or a malicious or compromised migration peer.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:incus affected >= 0, < 6.0.7; >= 6.1.0, < 7.0.2; >= 7.1.0, < 7.5.0 fixed 6.0.7, 7.0.2, 7.5.0

## How to check

Run 'incus version' on every Incus server, the client output also shows the server version. You are exposed if it is below 6.0.7 on the 6.0 LTS line, 6.1 to 7.0.1, or 7.1 to 7.4.x. Then check who can create instances or volumes: 'incus project list', 'incus config trust list', and 'incus remote list' and 'incus cluster list' for migration peers.

## Fix

Upgrade to Incus 6.0.7 or later (6.0 line), 7.0.2 or later (6.1 to 7.0 line), or 7.5.0 or later (7.1 line). Workaround from the vendor: only allow trusted clients to create instances and custom volumes, and only migrate from trusted servers.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115377
- 2026-10-23T22:47:27+00:00 analyst — Read upstream GHSA-579w-c4rw-c8q3 (stgraber) and CVE record. Needs API auth with low privileges (create instance or volume in a project), or a server the target is told to migrate from. No public PoC or exploitation found. I did not search social posts. GHSA lists only 7.5.0 as patched; 6.0.7 and 7.0.2 come from the CVE record.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115377

## Documents

- [advisory] Incus GHSA-579w-c4rw-c8q3: Arbitrary file write on host via symlink in migration stream https://github.com/lxc/incus/security/advisories/GHSA-579w-c4rw-c8q3
- [fix] Linux Containers - Incus news (security fixes release) https://linuxcontainers.org/incus/news/

## From the sources

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by planting symlinks in transferred volumes. Attackers can craft rsync or btrfs receive streams with a symlink such as rootfs pointing to the host root, writing files as root for full host compromise.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_