Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Critical severity, with a CVSS score of 9.9, published 6 November 2026.

Which products and versions are affected?

github.com/canonical/lxd (Go) < 0.0.0-20260630083100-c5184be310b1, SEMVER:introduced=0,fixed=0.0.0-20260630083100-c5184be310b1.

Is there a fix for This vulnerability?

Yes. github.com/canonical/lxd (Go): upgrade to 0.0.0-20260630083100-c5184be310b1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a hosted service.

Check whether you run Canonical Incus or github.com/canonical/lxd (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Incus arbitrary file write via trusted image hash

Q: Is there a fix for This vulnerability?

Yes. github.com/canonical/lxd (Go): upgrade to 0.0.0-20260630083100-c5184be310b1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected?

Check whether you run Canonical Incus or github.com/canonical/lxd (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: critical · CVSS 9.9 · Published 2026-11-06

Incus is a container management platform that allows administrators to provision and manage virtual machines and containers. A flaw in how Incus processes image downloads from user-supplied URLs allows an attacker operating a malicious image server to write arbitrary files on the host system with root privileges, potentially leading to complete system compromise through command execution.

Technologies: Canonical Incus, github.com/canonical/lxd (Go). Vendors: Canonical, Go.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Critical severity, with a CVSS score of 9.9, published 6 November 2026.
Which products and versions are affected?: github.com/canonical/lxd (Go) < 0.0.0-20260630083100-c5184be310b1, SEMVER:introduced=0,fixed=0.0.0-20260630083100-c5184be310b1.
Is there a fix for This vulnerability?: Yes. github.com/canonical/lxd (Go): upgrade to 0.0.0-20260630083100-c5184be310b1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a hosted service.
Am I affected?: Check whether you run Canonical Incus or github.com/canonical/lxd (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/canonical/lxd (Go): upgrade to 0.0.0-20260630083100-c5184be310b1 or later
```
go get github.com/canonical/lxd@v0.0.0-20260630083100-c5184be310b1
```

Technical details

The vulnerability exists in the direct image download code path, where the daemon trusts the Incus-Image-Hash HTTP header returned by a remote server and uses it directly as a file path component before validating the SHA-256 hash. By supplying a hash containing path traversal sequences (e.g., `../../../../etc/cron.d/...`), an attacker can write the downloaded image payload to arbitrary locations on the host filesystem. The file is created and written to before validation occurs, and cleanup is delayed, extending the window during which a malicious payload can be executed.

Affected products

Canonical Incus

Timeline

2026-11-06: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.