PT-2026-47214 · Incus · Incus
CVE-2026-48756
·
Published
2026-05-29
·
Updated
2026-07-07
CVSS v4.0
2.1
Low
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P |
Name of the Vulnerable Software and Affected Versions
incus versions 6.0.x and 7.0.0
Description
An authenticated user with
can create storage volumes permissions can cause a denial of service by crashing the incusd daemon. The issue occurs during the processing of an imported custom-volume backup when the volume snapshots[*].expires at field is absent in the backup tarball. This leads to an unguarded *time.Time dereference in the CreateCustomVolumeFromBackup() function within the internal/server/storage/backend.go file. An attacker can trigger this by sending a POST request to the endpoint '/1.0/storage-pools//volumes/custom' with a specially crafted backup containing a backup/index.yaml file where the expires at field is omitted for a snapshot. This results in a nil pointer dereference (CWE-476), causing the entire incusd process to panic and terminate.Recommendations
For incus versions 6.0.x and 7.0.0, implement a nil-check for the
ExpiresAt variable before dereferencing it in the CreateCustomVolumeFromBackup() function to ensure a default time is used if the field is absent.
As a temporary mitigation, restrict access to the '/1.0/storage-pools//volumes/custom' endpoint or limit the can create storage volumes permission to trusted users only.Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Incus