CVE-2026-47753

Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateInstanceFromBackup` in `internal/server/storage/backend.go` contains a nil-pointer dereference that an authenticated user with permission to create instances in any project can trigger remotely by uploading a crafted backup tarball. The Incus daemon panics and the process crashes, causing denial of service to every project on that cluster member. This is a sibling of `GHSA-fwj8-62r8-8p8m`, `GHSA-r7w7-mmxr-47r9`, and `GHSA-x5r6-jr56-89pv` (all assigned 2026-05-04). Those patches added guards on adjacent fields of the same `backup/config.Config` struct; the `Volume` field on the instance-import path was missed. Version 7.1.0 contains an updated patch.

CVSS

No CVSS.

References

Link	Resource
https://github.com/lxc/incus/commit/98e64f0a6fcfdc9676eea0246418d490c53297bf
https://github.com/lxc/incus/security/advisories/GHSA-8g7m-96c8-8wwc
https://github.com/lxc/incus/security/advisories/GHSA-8g7m-96c8-8wwc

Configurations

No configuration.

History

15 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Incus es un gestor de contenedores de sistema y máquinas virtuales. Antes de la versión 7.1.0, '(backend).CreateInstanceFromBackup' en 'internal/server/storage/backend.go' contiene una desreferencia de puntero nulo que un usuario autenticado con permiso para crear instancias en cualquier proyecto puede activar remotamente al subir un tarball de copia de seguridad manipulado. El demonio de Incus entra en pánico y el proceso falla, causando denegación de servicio a cada proyecto en ese miembro del clúster. Esto es un hermano de 'GHSA-fwj8-62r8-8p8m', 'GHSA-r7w7-mmxr-47r9' y 'GHSA-x5r6-jr56-89pv' (todos asignados el 04-05-2026). Esos parches añadieron protecciones en campos adyacentes de la misma estructura 'backup/config.Config'; el campo 'Volume' en la ruta de importación de instancias fue omitido. La versión 7.1.0 contiene un parche actualizado.

Information

Published : 2026-08-21 15:16

Updated : 2026-10-15 19:10

NVD link : CVE-2026-47753

Mitre link : CVE-2026-47753

CVE.ORG link : CVE-2026-47753

JSON object : View

Products Affected

No product.

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2026-47753", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47753", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-21T14:37:42.721981Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "lxc", "product": "incus", "versions": [{"status": "affected", "version": "< 7.1.0"}]}]}], "published": "2026-08-21T15:16:40.067", "references": [{"url": "https://github.com/lxc/incus/commit/98e64f0a6fcfdc9676eea0246418d490c53297bf", "source": "security-advisories@github.com"}, {"url": "https://github.com/lxc/incus/security/advisories/GHSA-8g7m-96c8-8wwc", "source": "security-advisories@github.com"}, {"url": "https://github.com/lxc/incus/security/advisories/GHSA-8g7m-96c8-8wwc", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateInstanceFromBackup` in `internal/server/storage/backend.go` contains a nil-pointer dereference that an authenticated user with permission to create instances in any project can trigger remotely by uploading a crafted backup tarball. The Incus daemon panics and the process crashes, causing denial of service to every project on that cluster member. This is a sibling of `GHSA-fwj8-62r8-8p8m`, `GHSA-r7w7-mmxr-47r9`, and `GHSA-x5r6-jr56-89pv` (all assigned 2026-05-04). Those patches added guards on adjacent fields of the same `backup/config.Config` struct; the `Volume` field on the instance-import path was missed. Version 7.1.0 contains an updated patch."}, {"lang": "es", "value": "Incus es un gestor de contenedores de sistema y m\u00e1quinas virtuales. Antes de la versi\u00f3n 7.1.0, '(backend).CreateInstanceFromBackup' en 'internal/server/storage/backend.go' contiene una desreferencia de puntero nulo que un usuario autenticado con permiso para crear instancias en cualquier proyecto puede activar remotamente al subir un tarball de copia de seguridad manipulado. El demonio de Incus entra en p\u00e1nico y el proceso falla, causando denegaci\u00f3n de servicio a cada proyecto en ese miembro del cl\u00faster. Esto es un hermano de 'GHSA-fwj8-62r8-8p8m', 'GHSA-r7w7-mmxr-47r9' y 'GHSA-x5r6-jr56-89pv' (todos asignados el 04-05-2026). Esos parches a\u00f1adieron protecciones en campos adyacentes de la misma estructura 'backup/config.Config'; el campo 'Volume' en la ruta de importaci\u00f3n de instancias fue omitido. La versi\u00f3n 7.1.0 contiene un parche actualizado."}], "lastModified": "2026-10-15T19:10:00.173", "sourceIdentifier": "security-advisories@github.com"}