PT-2026-37097 · Incus+1 · Incus+1
CVSS v4.0
5.3
Medium
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Incus versions prior to 7.0.0
Description
An authenticated user can cause the daemon to make blind outbound HEAD requests to arbitrary destinations. This occurs because the image import flow issues a request to a user-supplied URL via the
imgPostURLInfo() function before validating the request against project restrictions, such as restricted.images.servers. This creates a blind server-side request forgery (SSRF) primitive—a technique where an attacker forces a server to send requests to an unintended location—which can be used to probe internal services, unroutable address space, or cloud metadata endpoints reachable from the host. Additionally, these requests include custom headers (Incus-Server-Architectures and Incus-Server-Version) that disclose host environment information to the attacker-controlled endpoint.Recommendations
Update to version 7.0.0.
As a temporary workaround, restrict access to the image import functionality for untrusted authenticated users to minimize the risk of exploitation.
Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Incus
Red Os