Vulnerability in Lxc Incus
CVE-2026-63343
Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a `metadata.yaml` symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadata API. The `exec-output` and `templates/` paths were patched in a prior release using `Lstat` rejection and `os.OpenRoot` confinement; `metadata.yaml` was not included in either patch and remains exploitable. Version 7.3.0 patches the issue.
CVSS v3 metric
CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Lxc Incus — versions < 7.3.0
Weakness classification (CWE)
References
- https://github.com/lxc/incus/security/advisories/GHSA-fmjx-5j3g-997p (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2026-63343?
- CVE-2026-63343 is a critical-severity vulnerability in Lxc Incus, classified under External Control of File Name or Path. CVSS score: 9.9/10. Published 2026-08-21.
- How severe is CVE-2026-63343?
- Critical severity. CVSS v3 base score is 9.9 out of 10.