CVE-2026-41685

Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads of large amount of data by authenticated users can run the Incus server out of disk space, potentially taking down the host system. The impact here is limited for anyone using storage.images_volume and storage.backups_volume as those users will have large uploads be stored on those volumes rather than directly on the host filesystem. This is the default behavior on IncusOS. This issue has been patched in version 7.0.0.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/lxc/incus/releases/tag/v7.0.0	Patch Product
https://github.com/lxc/incus/security/advisories/GHSA-98vh-x9cx-9cfp	Exploit Vendor Advisory
https://github.com/lxc/incus/security/advisories/GHSA-98vh-x9cx-9cfp	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*

History

26 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Incus es un gestor de contenedores de sistema y máquinas virtuales. Antes de la versión 7.0.0, las cargas de grandes cantidades de datos por parte de usuarios autenticados pueden agotar el espacio en disco del servidor Incus, lo que podría provocar la caída del sistema anfitrión. El impacto aquí es limitado para cualquiera que utilice storage.images_volume y storage.backups_volume, ya que las cargas grandes de esos usuarios se almacenarán en esos volúmenes en lugar de directamente en el sistema de archivos del anfitrión. Este es el comportamiento predeterminado en IncusOS. Este problema ha sido parcheado en la versión 7.0.0.

Information

Published : 2026-05-07 14:16

Updated : 2026-10-26 20:10

NVD link : CVE-2026-41685

Mitre link : CVE-2026-41685

CVE.ORG link : CVE-2026-41685

JSON object : View

Products Affected

linuxcontainers

incus

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-41685", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41685", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-07T13:49:59.602172Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "lxc", "product": "incus", "versions": [{"status": "affected", "version": "< 7.0.0"}]}]}], "published": "2026-05-07T14:16:03.500", "references": [{"url": "https://github.com/lxc/incus/releases/tag/v7.0.0", "tags": ["Patch", "Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/lxc/incus/security/advisories/GHSA-98vh-x9cx-9cfp", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/lxc/incus/security/advisories/GHSA-98vh-x9cx-9cfp", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads of large amount of data by authenticated users can run the Incus server out of disk space, potentially taking down the host system. The impact here is limited for anyone using storage.images_volume and storage.backups_volume as those users will have large uploads be stored on those volumes rather than directly on the host filesystem. This is the default behavior on IncusOS. This issue has been patched in version 7.0.0."}, {"lang": "es", "value": "Incus es un gestor de contenedores de sistema y m\u00e1quinas virtuales. Antes de la versi\u00f3n 7.0.0, las cargas de grandes cantidades de datos por parte de usuarios autenticados pueden agotar el espacio en disco del servidor Incus, lo que podr\u00eda provocar la ca\u00edda del sistema anfitri\u00f3n. El impacto aqu\u00ed es limitado para cualquiera que utilice storage.images_volume y storage.backups_volume, ya que las cargas grandes de esos usuarios se almacenar\u00e1n en esos vol\u00famenes en lugar de directamente en el sistema de archivos del anfitri\u00f3n. Este es el comportamiento predeterminado en IncusOS. Este problema ha sido parcheado en la versi\u00f3n 7.0.0."}], "lastModified": "2026-10-26T20:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF8EBB4B-C1F0-44C5-B063-9CF8EB6E0972", "versionEndExcluding": "7.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}