Will Incus CVE-2026-115377 let attackers write arbitrary files to host roots during instance migration?
CVE-2026-115377 enables arbitrary file writes on hosts during instance migration by exploiting symlinks in transferred volumes, rated Critical at 9.4 by the NVD.
Key points
- The vulnerability affects Incus versions prior to 6.0.7, 7.0.2, and 7.5.0.
- Attackers can craft malicious migration streams containing symlinks pointing to the host root filesystem.
- The flaw allows writing files as root, potentially leading to full host compromise via arbitrary file writes.
A critical vulnerability in Incus allows attackers to write arbitrary files on the host system during instance migration. According to the National Vulnerability Database record for CVE-2026-115377, the flaw exists in versions before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0. The issue stems from how the software handles symlinks within transferred volumes, specifically allowing malicious migration sources to plant these links.
How does the exploit mechanism work?
The vulnerability is classified under CWE-59, which relates to improper link resolution. Attackers can craft specific rsync or btrfs receive streams that include a symlink, such as one named rootfs, pointing directly to the host’s root directory. When the migration process processes this stream, it follows the symlink and writes data to the host filesystem instead of the intended container volume. This behavior allows the attacker to overwrite critical system files on the host machine.
What is the severity and impact?
The National Vulnerability Database rates CVE-2026-115377 as Critical with a CVSS score of 9.4. The primary impact is arbitrary file write capability on the host system. Because the migration process typically runs with elevated privileges, the files written via these crafted symlinks are created as root. This privilege level allows an attacker to gain full control over the host operating system, effectively compromising the entire infrastructure node hosting the vulnerable Incus instances.
Which versions require immediate attention?
Users running Incus must check their current version against the fixed releases listed in the advisory. The vulnerability affects versions prior to 6.0.7, the 6.1.0 branch up to 7.0.2, and the 7.1.0 branch up to 7.5.0. Any installation running a version lower than these specific cutoffs is exposed to the arbitrary file write risk. The NVD record explicitly identifies these version ranges as affected, implying that upgrading to these specific versions or later resolves the issue.
What steps should administrators take?
Administrators should immediately verify their Incus version and compare it to the safe versions listed above. Those on affected versions should prioritize upgrading to 6.0.7, 7.0.2, or 7.5.0 respectively. Until the update is applied, organizations should restrict migration sources to trusted internal networks only, as the exploit requires a malicious migration source to be processed. Monitoring logs for unusual file creation events on the host during migration windows can also help detect active exploitation attempts.
What analysts watch for
Security analysts investigating potential exploitation of this class of vulnerability typically examine migration logs for unexpected symlink creation or resolution events. They check for anomalies in rsync or btrfs receive stream metadata, particularly looking for symbolic links pointing outside the designated container volume to sensitive host directories. Teams usually inspect the host filesystem for new or modified root-level files that appeared concurrently with migration activities. Analysts also review access patterns to determine if unauthorized processes gained elevated privileges during data transfer operations.
Background: CVSS score
The CVSS score provides a standardized number to rank vulnerability severity. Small teams should use it to prioritize patches, but must adjust for business context. A high score does not always mean immediate danger if the affected component is isolated or unused.
Read the full guide: CVSS Scores Explained: What Small Teams Must Know
What to do and how to stay safe: Incus
- Verify your current Incus version and compare it against the safe versions listed in the CVE advisory.
- Upgrade immediately to version 6.0.7, 7.0.2, or 7.5.0 if you are running an affected version.
- Restrict migration sources to trusted, authenticated internal endpoints until patches are applied.
- Monitor host filesystems for unexpected file modifications or creation during active migration processes.
Step-by-step guide: Patch Management: Why Updates Fail and How to Fix It
General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific CVE ID covers this Incus vulnerability?
The vulnerability is tracked under CVE-2026-115377 in the National Vulnerability Database.
Which Incus versions are no longer vulnerable?
Versions 6.0.7, 7.0.2, and 7.5.0 and later are listed as fixed in the advisory.
How do attackers exploit this flaw?
Attackers craft malicious migration streams with symlinks pointing to the host root, causing arbitrary file writes as root.
