CVE-2026-63343

Name of the Vulnerable Software and Affected Versions Incus versions prior to 7.3.0

Description An authenticated user can read or overwrite any file on the host system with root privileges by using a malicious image. This is possible because the instance metadata API does not properly handle a metadata.yaml symlink that points to an arbitrary host path. While previous updates addressed similar issues in exec-output and templates/ paths using Lstat rejection and os.OpenRoot confinement, the metadata.yaml file remained unprotected.

Recommendations Update to version 7.3.0.