Secure Incus Hosts Against Symlink-Driven File Write Vulnerabilities

Attackers can gain full control of Incus hosts by exploiting a critical vulnerability in the instance migration process. This flaw, identified as CVE-2026-115377, allows malicious actors to write arbitrary files to the host system. The National Vulnerability Database rates the severity of this issue at 9.4, classifying it as critical. Successful exploitation grants the attacker root-level access on the underlying host machine.

The vulnerability exists in Incus versions prior to 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0. According to the NVD record, the weakness stems from how the software handles data transfers during instance migration. Attackers craft malicious migration sources containing symbolic links that point to sensitive host directories. When the system processes these transfers, it inadvertently writes files to the host root filesystem.

Attack Mechanics and Impact

The attack vector relies on the manipulation of data streams used for moving instances between hosts. Specifically, attackers can craft rsync or btrfs receive streams that include symbolic links. These links, such as one named rootfs, are configured to point to the host's root directory. As the migration process unfolds, the system follows these links and writes data directly to the host system. This results in arbitrary file writes with root privileges, leading to full host compromise.

This type of arbitrary file write vulnerability mirrors other infrastructure flaws reported recently. For instance, Shell Bulletin reported on October 13, 2026, about a high-severity flaw in Risesoft-y9 v9.6.11 that also allowed unauthenticated file writes. While the specific products differ, the underlying risk of attackers writing files to critical system locations remains a consistent threat to digital infrastructure.

Affected Systems and Scope

The vulnerability affects a wide range of Incus deployments. Any system running Incus versions before 6.0.7 is vulnerable. Additionally, systems on the 6.1.0 branch are affected before version 7.0.2. The 7.1.0 branch is also at risk before version 7.5.0. The NVD record explicitly lists lxc incus as the affected product. Organizations using these versions for container management or instance migration are exposed to this threat.

The impact is severe because the attacker gains root access on the host. This level of access allows them to write files as root for full host compromise. The vulnerability allows malicious migration sources to write host files by planting symlinks in transferred volumes. This makes any system processing these migrations susceptible to arbitrary file writes.

What to watch

Organizations should monitor their Incus instances for any unusual file activity during migration processes. Security teams should verify that migration sources are trusted and validated before processing. Look for unexpected symbolic links in transferred volumes, as these are the primary mechanism for exploitation. Additionally, check for any unauthorized changes to host root files, which could indicate a successful attack.

What made it possible

This vulnerability arises from improper handling of symbolic links during data ingestion. Systems that process external data streams without validating the integrity of file paths are susceptible to such attacks. The weakness allows attackers to redirect write operations from the intended destination to arbitrary locations on the host. This technique is common in scenarios where trust is implicitly granted to incoming data sources. Teams usually implement strict validation of file paths and symlink targets to prevent such redirections.

What to do and how to stay safe: Incus

• Audit all Incus installations to determine if they run vulnerable versions prior to 6.0.7, 7.0.2, or 7.5.0.
• Restrict migration sources to trusted and verified providers to prevent the injection of malicious symbolic links.
• Monitor system logs for unexpected file writes or symlink creations during instance migration activities.
• Once the vendor provides an update, apply patches immediately to mitigate the risk of arbitrary file writes.

Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-115377?

The CVSS score for CVE-2026-115377 is 9.4, which is rated as critical severity.

Which Incus versions are affected by this vulnerability?

Incus versions before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 are affected.

How do attackers exploit this vulnerability?

Attackers craft malicious migration sources with symlinks that point to the host root, allowing arbitrary file writes.