CVE catalog

CVE-2026-48769

lxd affected and fixed versions

Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches the issue.

Severity: Critical · CVSS 9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published: Aug 21, 2026, 2:38:38 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.73% · Oct 27, 2026

Projects and upstream resources

[lxd][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Version impact has not been established. The original provider fields are retained below.

Provider details and historical evidence

Original provider fields

{
  "package_releases": [
    {
      "name": "lxd",
      "status": "fixed",
      "release": "trixie",
      "version": "5.0.2+git20231211.1364ae4-9+deb13u7"
    },
    {
      "name": "lxd",
      "status": "fixed",
      "release": "trixie-security",
      "version": "5.0.2+git20231211.1364ae4-9+deb13u7"
    },
    {
      "name": "lxd",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "5.0.2-5+deb12u6"
    },
    {
      "name": "lxd",
      "status": "vulnerable",
      "release": "bookworm-security",
      "version": "5.0.2-5+deb12u6"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "lxd",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "5.0.2+git20231211.1364ae4-9+deb13u7"
    },
    {
      "bug": null,
      "name": "lxd",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "end-of-life",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "github.com/lxc/incus",
      "ecosystem": "Go",
      "fixed_version": ""
    },
    {
      "name": "github.com/lxc/incus/v6",
      "ecosystem": "Go",
      "fixed_version": ""
    },
    {
      "name": "github.com/lxc/incus/v7",
      "ecosystem": "Go",
      "fixed_version": "7.2.0"
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[lxd]Unknown
Details (4)
- 5.0.2-5+deb12u6 · amd64 · bookworm
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · arm64 · bookworm
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · amd64 · bookworm-security
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · arm64 · bookworm-security
  Affected
  dsa · lxd · debian · bookworm
[lxd-agent]Unknown
Source package: [lxd]
Details (4)
- 5.0.2-5+deb12u6 · amd64 · bookworm
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · arm64 · bookworm
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · amd64 · bookworm-security
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · arm64 · bookworm-security
  Affected
  dsa · lxd · debian · bookworm
[lxd-client]Unknown
Source package: [lxd]
Details (4)
- 5.0.2-5+deb12u6 · amd64 · bookworm
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · arm64 · bookworm
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · amd64 · bookworm-security
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · arm64 · bookworm-security
  Affected
  dsa · lxd · debian · bookworm
[lxd-migrate]Unknown
Source package: [lxd]
Details (4)
- 5.0.2-5+deb12u6 · amd64 · bookworm
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · arm64 · bookworm
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · amd64 · bookworm-security
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · arm64 · bookworm-security
  Affected
  dsa · lxd · debian · bookworm
[lxd-tools]Unknown
Source package: [lxd]
Details (4)
- 5.0.2-5+deb12u6 · amd64 · bookworm
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · arm64 · bookworm
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · amd64 · bookworm-security
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · arm64 · bookworm-security
  Affected
  dsa · lxd · debian · bookworm

Observed: Oct 27, 2026, 7:04:17 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [Go Vulnerability Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]