CVE-2026-48754: incus < 7.1.0

Affected technology

incus · < 7.1.0
lxc

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated user with `can_create_instances` permission on any project can crash the `incusd` daemon by uploading an instance backup tarball whose `dependent_volumes[*]` block contains a nil snapshot pointer (or omits `volume:` / `pool:`). Vendor/CNA’s CVSS 4.0 assessment (base score 2.1/10) rates confidentiality and integrity impact as none; availability impact as low.