CVE-2026-48769: Incus has an arbitrary file write on its client due to trusted image hash

June 26, 2026 (updated November 5, 2026)

An arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the server.

References

github.com/advisories/GHSA-f6m5-xw2g-xc4x
github.com/canonical/lxd/security/advisories/GHSA-pjff-c2wc-f6jm
github.com/lxc/incus/security/advisories/GHSA-f6m5-xw2g-xc4x
nvd.nist.gov/vuln/detail/CVE-2026-48769

Code Behaviors & Features

Detect and mitigate CVE-2026-48769 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →