CVE-2026-23954: Incus Escape: From Templates to Host Root

#security #cve #cybersecurity

Incus Escape: From Templates to Host Root

Vulnerability ID: CVE-2026-23954
CVSS Score: 8.7
Published: 2026-01-22

A critical path traversal and symbolic link vulnerability in the Incus container manager allows privileged container users to escape confinement and execute arbitrary code as root on the host system.

TL;DR

Incus (an LXD fork) trusted user-supplied paths in container image templates too much. By crafting a malicious image with a specific metadata.yaml, an attacker can trick the root-privileged Incus daemon into reading or writing files outside the container rootfs. This is trivially exploitable for host-level Remote Code Execution (RCE).

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-22 (Path Traversal)
CVSS v3.1: 8.7 (High)
Attack Vector: Adjacent Network (AV:A)
Impact: Confidentiality High, Integrity High
Exploit Status: PoC Available
Prerequisites: Container launch permissions (incus group)

Affected Systems

Incus Container Manager (Feature release <= 6.20)
Incus Container Manager (LTS release <= 6.0.5)
Linux Systems running vulnerable Incus versions
Incus: <= 6.0.5 (Fixed in: 6.0.6)
Incus: <= 6.20.0 (Fixed in: 6.21.0)

Exploit Details

Incus Security Advisory: Official advisory containing the PoC details and patch information.

Mitigation Strategies

Upgrade Incus to version 6.21.0 or 6.0.6 immediately.
Restrict membership of the 'incus' and 'incus-admin' groups to trusted administrators only.
Disable the ability for unprivileged users to import custom images.

Remediation Steps: