CVE-2026-48751: Incus has a restricted project bypass leading to arbitrary command execution

June 26, 2026 (updated November 5, 2026)

Instance snapshots ignore the restricted.containers.lowlevel=block setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as raw.lxc and raw.qemu.

References

github.com/advisories/GHSA-48q5-w887-33wv
github.com/canonical/lxd/security/advisories/GHSA-47w9-6r3f-938g
github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv
nvd.nist.gov/vuln/detail/CVE-2026-48751

Code Behaviors & Features

Detect and mitigate CVE-2026-48751 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →