Is CVE-2026-48756 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48756 being exploited in the wild.

How severe is CVE-2026-48756?

Medium severity, with a CVSS score of 4, published 21 August 2026.

Which products and versions are affected?

github.com/lxc/incus (Go) SEMVER:introduced=0; github.com/lxc/incus/v6 (Go) SEMVER:introduced=0; github.com/lxc/incus/v7 (Go) SEMVER:introduced=0,fixed=7.1.0; github.com/lxc/incus/v7/cmd/incusd (Go) < 7.1.0, SEMVER:introduced=0,fixed=7.1.0; and 1 more.

Is there a fix for CVE-2026-48756?

Yes. github.com/lxc/incus/v7 (Go): upgrade to 7.1.0 or later; github.com/lxc/incus/v7/cmd/incusd (Go): upgrade to 7.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48756 attacked?

It is attacked over the network or with local access, in a software library.

Am I affected by CVE-2026-48756?

Check whether you run github.com/lxc/incus (Go), github.com/lxc/incus/v6 (Go), github.com/lxc/incus/v7 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48756: LXC Incus nil-pointer dereference in CreateCustomVolumeFromBackup

Q: Is there a fix for CVE-2026-48756?

Yes. github.com/lxc/incus/v7 (Go): upgrade to 7.1.0 or later; github.com/lxc/incus/v7/cmd/incusd (Go): upgrade to 7.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-48756 attacked?

It is attacked over the network or with local access, in a software library.

Q: Am I affected by CVE-2026-48756?

Check whether you run github.com/lxc/incus (Go), github.com/lxc/incus/v6 (Go), github.com/lxc/incus/v7 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48756 · Severity: medium · CVSS 4 · Published 2026-08-21

Incus, a tool for managing containers and virtual machines, is vulnerable to a denial-of-service attack. An authenticated user can crash the central management service (incusd) by uploading a specially crafted backup file that is missing specific timing information. This crash stops all active container operations and prevents the system from responding to new requests until an administrator manually restarts the service.

Technologies: github.com/lxc/incus (Go), github.com/lxc/incus/v6 (Go), github.com/lxc/incus/v7 (Go), github.com/lxc/incus/v7/cmd/incusd (Go), Linux Containers Project Incus. Vendors: Go, Linux Containers Project.

Quick answers

Is CVE-2026-48756 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48756 being exploited in the wild.
How severe is CVE-2026-48756?: Medium severity, with a CVSS score of 4, published 21 August 2026.
Which products and versions are affected?: github.com/lxc/incus (Go) SEMVER:introduced=0; github.com/lxc/incus/v6 (Go) SEMVER:introduced=0; github.com/lxc/incus/v7 (Go) SEMVER:introduced=0,fixed=7.1.0; github.com/lxc/incus/v7/cmd/incusd (Go) < 7.1.0, SEMVER:introduced=0,fixed=7.1.0; and 1 more.
Is there a fix for CVE-2026-48756?: Yes. github.com/lxc/incus/v7 (Go): upgrade to 7.1.0 or later; github.com/lxc/incus/v7/cmd/incusd (Go): upgrade to 7.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48756 attacked?: It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-48756?: Check whether you run github.com/lxc/incus (Go), github.com/lxc/incus/v6 (Go), github.com/lxc/incus/v7 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/lxc/incus/v7 (Go): upgrade to 7.1.0 or later
```
go get github.com/lxc/incus/v7@v7.1.0
```
github.com/lxc/incus/v7/cmd/incusd (Go): upgrade to 7.1.0 or later
```
go get github.com/lxc/incus/v7/cmd/incusd@v7.1.0
```

Technical details

A nil-pointer dereference (CWE-476) exists in `internal/server/storage/backend.go` within the `CreateCustomVolumeFromBackup` function. The vulnerability occurs because the `ExpiresAt` field of a volume snapshot is dereferenced without a nil check when importing a custom volume backup. An authenticated attacker with `can_create_storage_volumes` permissions can trigger a panic in the `incusd` daemon by uploading a backup tarball containing a `backup/index.yaml` where the `expires_at` field is omitted. Because the operation runner lacks a recovery mechanism, the resulting panic terminates the entire process. This issue is fixed in version 7.1.0.

Affected products

LXC Incus < 7.1.0

Identifiers

CVE-2026-48756
GHSA-xhqx-mgh3-3h7q
GO-2026-5810

Timeline

2026-05-28: disclosed
2026-06-26: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.