lxc incus vulnerabilities

CVEs per yearBy the year they were published

1. 20253
2. 202644

Newest CVEs

• CVE-2026-115378

  Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pull

  lxc · incus

  Medium6.9
• CVE-2026-115377

  Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream

  lxc · incus

  Critical9.4
• CVE-2026-115376

  Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 Project Restriction Bypass via Custom Volume Copy

  lxc · incus

  High8.3
• CVE-2026-115375

  Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes

  lxc · incus

  Critical9.4
• CVE-2026-115374

  Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Unsigned Header Bypass in Presigned S3 Upload URLs

  lxc · incus

  High7.1
• CVE-2026-115373

  Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid}

  lxc · incus

  High7.0
• CVE-2026-115372

  Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options

  lxc · incus

  Critical9.0
• CVE-2026-115371

  LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys Endpoints

  lxc · incus

  High7.1
• CVE-2026-115370

  Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh

  lxc · incus

  Medium5.3
• CVE-2026-63343

  Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root

  lxc · incus

  Critical9.9