CVE-2026-63343
Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a metadata.yaml symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadata API. The exec-output and templates/ paths were patched in a prior release using Lstat rejection and os.OpenRoot confinement; metadata.yaml was not included in either patch and remains exploitable. Version 7.3.0 patches the issue.
CSIRTS triage
- What
- Multiple security issues in Incus allow bypass of security restrictions and privilege escalation.
- Who is affected
- Systems running Incus container and virtual machine manager.
- Urgency
- High; privilege escalation and security bypass are critical risks.
- Action
- Update Incus to the patched version referenced in DSA-6407-1.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-63343
Get an email if CVE-2026-63343 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.48% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 40% of all EPSS-scored CVEs.
Advisory coverage (2)
- criticalCVE-2026-63343: Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious i…nvd · 2026-08-21
- unknownDSA-6407-1 incus - security updatedebian · 2026-07-31
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-63343)