Executive brief
Incus, a container and virtual machine management tool, is vulnerable to a denial-of-service attack. An authenticated user can crash the management daemon by uploading a specially crafted backup file that is missing specific volume information. This crash stops all ongoing container and VM operations on the affected server and prevents new requests until the service is manually restarted.
Technical details
A nil-pointer dereference exists in the `(*backend).CreateInstanceFromBackup` function within `internal/server/storage/backend.go`. The vulnerability is triggered when the `Volume` field in a backup's `index.yaml` is omitted, causing the Go runtime to encounter a nil pointer when attempting to access `srcBackup.Config.Volume.Config`. An attacker with 'can_create' permissions in any project can exploit this by performing a POST request to the `/1.0/instances` endpoint with a crafted tarball. Because the daemon does not implement a recovery mechanism for this panic, the entire `incusd` process terminates, resulting in a complete denial of service for the cluster member. The issue is fixed in version 7.1.0.
Affected products
- LXC Incus < 7.1.0
Timeline
- 2026-05-28: disclosed
- 2026-05-28: patched
- 2026-06-10: advisory