PT-2026-37097 · Incus · Incus

Stamparm

·

Published

2026-05-04

·

Updated

2026-05-05

·

CVE-2026-35527

CVSS v4.0

5.3

Medium

VectorAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Incus versions prior to 7.0.0
Description An authenticated user can cause the daemon to make blind outbound HEAD requests to arbitrary destinations. This occurs because the image import flow issues a request to a user-supplied URL via the imgPostURLInfo() function before validating the request against project restrictions, such as restricted.images.servers. This creates a blind server-side request forgery (SSRF) primitive—a technique where an attacker forces a server to send requests to an unintended location—which can be used to probe internal services, unroutable address space, or cloud metadata endpoints reachable from the host. Additionally, these requests include custom headers (Incus-Server-Architectures and Incus-Server-Version) that disclose host environment information to the attacker-controlled endpoint.
Recommendations Update to version 7.0.0. As a temporary workaround, restrict access to the image import functionality for untrusted authenticated users to minimize the risk of exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-35527
GHSA-8GW4-P4WQ-4HCV

Affected Products

Incus