Does Incus migration flaw allow host takeover via symlinks?

The short version

• Malicious migration sources can plant symlinks in transferred volumes to write host files.
• Attackers can craft receive streams with symlinks pointing to the host root directory.
• Successful exploitation allows writing files as root, leading to full host compromise.

The details

Security researchers have identified a severe vulnerability within the Incus container management tool, specifically affecting versions prior to 6.0.7, as well as those between 6.1.0 and 7.0.2, and between 7.1.0 and 7.5.0, according to National Vulnerability Database records. The flaw, tracked as CVE-2026-115377, carries a CVSS score of 9.4, which is classified as Critical.

This rating reflects the high potential for damage and the ease with which an attacker could exploit the issue without requiring complex prerequisites. The core weakness stems from how Incus handles volume transfers during instance migrations, leaving the underlying host system exposed to manipulation by untrusted source data.

The technical mechanism involves the creation of malicious receive streams using either rsync or btrfs protocols. An attacker can craft these streams to include symbolic links, such as one named rootfs, that point directly to the host’s root directory. When the vulnerable Incus instance processes these transfers, it follows the symlinks and writes files directly to the host filesystem. Because these operations occur with root privileges, the attacker gains the ability to modify critical system files, effectively achieving full control over the compromised host machine.

The context

This issue is categorised under CWE-59, which relates to link following vulnerabilities, commonly known as symlink following. The National Vulnerability Database records confirm that the affected software is LXC Incus. The specific version ranges highlighted indicate that multiple release branches are susceptible to this attack vector. There is no mention in the source material of any confirmed fixes or patches currently available for these versions. Consequently, organisations running these specific builds remain exposed to the risk of arbitrary file writes via malicious migration sources until a vendor update is released.

Next steps

• Identify all systems running Incus versions before 6.0.7, 6.1.0 to 7.0.2, or 7.1.0 to 7.5.0.
• Restrict migration sources to trusted and verified origins only.
• Monitor for unusual file modifications on the host system during migration tasks.
• Await official vendor guidance or updates to address CVE-2026-115377.

What defenders should look for

Teams should monitor for unexpected file changes on the host filesystem during container migration processes. Check logs for symbolic link creation or manipulation within transferred volumes, as this often precedes exploitation. Look for unusual write permissions or root-level file modifications that do not align with standard migration activities. If suspicious behaviour is detected, isolate the affected host from the network immediately. Disable the migration source and review access controls to prevent further unauthorised interactions. Investigate any compromised files and assess the extent of potential data exfiltration or system alteration.

What to do and how to stay safe: Incus

• Audit your current Incus version against the affected ranges listed in the advisory.
• Implement strict validation checks for all incoming migration data and sources.
• Enable detailed logging for volume transfer operations to detect anomalies early.
• Plan for an update once the vendor provides a confirmed fix for this vulnerability.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Incus versions are affected by CVE-2026-115377?

Versions before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 are affected.

What is the CVSS score for this vulnerability?

The CVSS score is 9.4, which is rated as Critical.

How can an attacker exploit this flaw?

Attackers can craft rsync or btrfs receive streams with symlinks to write host files.