Incus 7.2 Release Announcement

stgraber.org • November 8, 2026

It’s another pretty busy release for us with a varied set of new features across the board as well as the usual set of performance improvements and bugfixes.

This fixes the following security issues:

CVE-2026-48749 (critical) – Arbitrary file read+write on host via rootfs/ symlink in malicious image

CVE-2026-48750 (critical) – Arbitrary file write on host via exec-output symlink in crafted image

CVE-2026-48751 (critical) – Restricted project bypass leading to arbitrary command execution

CVE-2026-48752 (critical) – Arbitrary file read+write on host via templates/ symlink in malicious image

CVE-2026-48755 (critical) – Argument injection in backup compression algorithm leading to arbitrary file write and command execution

CVE-2026-48769 (critical) – Arbitrary file write on client due to trusted image hash

CVE-2026-55621 (high) – Project restriction bypass for custom volume copy across projects

CVE-2026-55622 (high) – Project restriction bypass in instance copy across projects

On the feature front, the highlights for this release are:

Per-instance SELinux integration

New incus default CLI command

Filtered server info by default

Keepalive timeout from the CLI

Better OS-specific handling of CLI configuration

Standalone server certificate update

Static network configuration for OCI containers

Dynamic addresses in proxy NAT mode

Expanded NBD access to VMs

Btrfs compression for storage volumes

InfiniBand SR-IOV GUID configuration

Websocket origin restriction

The full announcement and changelog can be found here . And for those who prefer videos, here’s the release overview video :

You can take the latest release of Incus up for a spin through our online demo service at:

And as always, my company is offering commercial support on Incus, ranging from by-the-hour support contracts to one-off services on things like initial migration from LXD, review of your deployment to squeeze the most out of Incus or even feature sponsorship. You’ll find all details of that here:

Donations towards my work on this and other open source projects is also always appreciated, you can find me on Github Sponsors , Patreon and Ko-fi .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Path Traversal Vulnerability in Canonical LXD and Incus A critical path traversal vulnerability (CVE-2026-48769) has been identified in Canonical LXD and Linux Containers Incus, allowing authenticated users to exploit improper input validation. This flaw enables attackers to write arbitrary files on the host filesystem as root, leading to remote code execution. The vulnerability arises from the handling of the Incus-Image-Hash HTTP header during image imports, where the header is not adequately validated before being used in file paths. Affected versions include Incus 4.0.0 to 6.0.0 and Canonical LXD versions below 6.9.0. A public proof-of-concept exploit is available, increasing the urgency for patching. Users are advised to upgrade to the patched versions and restrict access to the APIs. The CVSS score for this vulnerability is 9.9, indicating a critical severity level. CISA has not listed this vulnerability in its KEV catalog. 1 sources 78

Extracted Entities

Incus 7.2 Release Announcement

The full story

Extracted Entities

CVEs (8)

CWE Weaknesses (2)

Platforms (1)