CVE-2026-48751

Name of the Vulnerable Software and Affected Versions Incus (affected versions not specified)

Description Instance snapshots ignore the restricted.containers.lowlevel=block setting, which allows for arbitrary command execution on the Incus server. This occurs by abusing lowlevel hooks such as raw.lxc and raw.qemu. A malicious actor can craft an instance and snapshot locally, move them to a restricted project, and restore the snapshot to execute arbitrary commands on the host with root privileges, effectively bypassing project restrictions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.