lxc has 18 CVEs on record. Disclosure cadence is accelerating: 18 in the last 90 days against 0 in the 90 before. The busiest recent month was August 2026 with 12. The median CVSS is 9.9 (critical), with 9 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-73 (4) and CWE-284 (3). Most affected products: github.com/lxc/incus/v7/cmd/incusd (10), incus (5), github.com/lxc/incus/v7 (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 9.9
- Publish → KEV
- —
- Last 90 days
- 18 prev 0
Products
- github.com/lxc/incus/v7/cmd/incusd 10
- incus 5
- github.com/lxc/incus/v7 2
- lxc-ci 1
Worst active — by depth score
CVE-2026-115377Critical· 9.9Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream55CVE-2026-115375Critical· 9.9Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes55CVE-2026-48769Critical· 9.9Incus is a system container and virtual machine manager55CVE-2026-48755Critical· 9.9Incus is a system container and virtual machine manager55CVE-2026-48753Critical· 9.9Incus is a system container and virtual machine manager55
lxc vulnerabilities
CVEs affecting lxc, newest first. Open any entry for full detail, references, and exploit status.
18 CVEsRSS
CVE-2026-115377Critical· 9.9Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by planting symlinks in transferred volumes. Attackers can craft rs…
CVE-2026-115376High· 7.7Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 Project Restriction Bypass via Custom Volume Copy
Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type. Attackers can send crafted POST requests to the custom volumes…
CVE-2026-115375Critical· 9.9Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems from unvalidated dependent custom volume names in instance ba…
CVE-2026-115371High· 7.1LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys Endpoints
Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket k…
CVE-2026-115370Medium· 4.3Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh
Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance cre…
CVE-2026-52727High· 7.2lxc-ci contains continuous integration and image-build scripts for LXC
lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg…
CVE-2026-55621High· 7.7Incus is a system container and virtual machine manager
Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of …
CVE-2026-55622High· 7.7Incus is a system container and virtual machine manager
Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an in…
CVE-2026-47753MediumIncus is a system container and virtual machine manager
Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateInstanceFromBackup` in `internal/server/storage/backend.go` contains a nil-pointer dereference that an authenticated user with permission …
CVE-2026-48749Critical· 9.9Incus is a system container and virtual machine manager
Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 fi…
CVE-2026-48750Critical· 9.9Incus is a system container and virtual machine manager
Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output` parameter of the `/instances/$name/exec` endpoint stores the output of the command in the `exec-output` directory of the instance. If `e…
CVE-2026-48751Critical· 9.9Incus is a system container and virtual machine manager
Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus server by abusing lowlev…
CVE-2026-48752Critical· 9.9Incus is a system container and virtual machine manager
Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command executio…
CVE-2026-48753Critical· 9.9Incus is a system container and virtual machine manager
Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary co…
CVE-2026-48754LowIncus is a system container and virtual machine manager
Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).createDependentVolumesFromBackup` in `internal/server/storage/backend.go` contains a cluster of unguarded pointer derefs on every dependent-volu…
CVE-2026-48755Critical· 9.9Incus is a system container and virtual machine manager
Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary fi…
CVE-2026-48756LowIncus is a system container and virtual machine manager
Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateCustomVolumeFromBackup` in `internal/server/storage/backend.go` contains an unguarded `*time.Time` dereference on the `ExpiresAt` field of…
CVE-2026-48769Critical· 9.9Incus is a system container and virtual machine manager
Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary com…