OPENSUSE-SU-2026:11651-1
Vulnerability from csaf_opensuse - Published: 2026-08-31 00:00 - Updated: 2026-09-17 17:22Summary
incus-7.4-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: incus-7.4-1.1 on GA media
Description of the patch: These are all security issues fixed in the incus-7.4-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-11651
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
6.5 (Medium)
Affected products
Recommended
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:incus-0:7.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
24 products, the same list as for
CVE-2026-39402
Threats
Impact
moderate
Affected products
Recommended
24 products, the same list as for
CVE-2026-39402
Threats
Impact
critical
Affected products
Recommended
24 products, the same list as for
CVE-2026-39402
Threats
Impact
critical
Affected products
Recommended
24 products, the same list as for
CVE-2026-39402
Threats
Impact
critical
Affected products
Recommended
24 products, the same list as for
CVE-2026-39402
Threats
Impact
critical
Affected products
Recommended
24 products, the same list as for
CVE-2026-39402
Threats
Impact
critical
Affected products
Recommended
24 products, the same list as for
CVE-2026-39402
Threats
Impact
moderate
Affected products
Recommended
24 products, the same list as for
CVE-2026-39402
Threats
Impact
critical
Affected products
Recommended
24 products, the same list as for
CVE-2026-39402
Threats
Impact
moderate
Affected products
Recommended
24 products, the same list as for
CVE-2026-39402
Threats
Impact
critical
Affected products
Recommended
24 products, the same list as for
CVE-2026-39402
Threats
Impact
important
Affected products
Recommended
24 products, the same list as for
CVE-2026-39402
Threats
Impact
important
Affected products
Recommended
24 products, the same list as for
CVE-2026-39402
Threats
Impact
moderate
Affected products
Recommended
24 products, the same list as for
CVE-2026-39402
Threats
Impact
critical
Affected products
Recommended
24 products, the same list as for
CVE-2026-39402
Threats
Impact
critical
Affected products
Recommended
24 products, the same list as for
CVE-2026-39402
Threats
Impact
critical
Affected products
Recommended
24 products, the same list as for
CVE-2026-39402
Threats
Impact
critical
Affected products
Recommended
24 products, the same list as for
CVE-2026-39402
Threats
Impact
critical
Affected products
Recommended
24 products, the same list as for
CVE-2026-39402
Threats
Impact
moderate
Affected products
Recommended
24 products, the same list as for
CVE-2026-39402
Threats
Impact
moderate
References
64 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "incus-7.4-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the incus-7.4-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2026-11651",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11651-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39402 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39402/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-47753 page",
"url": "https://www.suse.com/security/cve/CVE-2026-47753/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-48749 page",
"url": "https://www.suse.com/security/cve/CVE-2026-48749/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-48750 page",
"url": "https://www.suse.com/security/cve/CVE-2026-48750/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-48751 page",
"url": "https://www.suse.com/security/cve/CVE-2026-48751/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-48752 page",
"url": "https://www.suse.com/security/cve/CVE-2026-48752/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-48753 page",
"url": "https://www.suse.com/security/cve/CVE-2026-48753/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-48754 page",
"url": "https://www.suse.com/security/cve/CVE-2026-48754/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-48755 page",
"url": "https://www.suse.com/security/cve/CVE-2026-48755/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-48756 page",
"url": "https://www.suse.com/security/cve/CVE-2026-48756/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-48769 page",
"url": "https://www.suse.com/security/cve/CVE-2026-48769/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-55621 page",
"url": "https://www.suse.com/security/cve/CVE-2026-55621/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-55622 page",
"url": "https://www.suse.com/security/cve/CVE-2026-55622/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-62313 page",
"url": "https://www.suse.com/security/cve/CVE-2026-62313/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-62867 page",
"url": "https://www.suse.com/security/cve/CVE-2026-62867/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-62940 page",
"url": "https://www.suse.com/security/cve/CVE-2026-62940/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-62941 page",
"url": "https://www.suse.com/security/cve/CVE-2026-62941/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-63125 page",
"url": "https://www.suse.com/security/cve/CVE-2026-63125/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-63343 page",
"url": "https://www.suse.com/security/cve/CVE-2026-63343/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-81500 page",
"url": "https://www.suse.com/security/cve/CVE-2026-81500/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-81501 page",
"url": "https://www.suse.com/security/cve/CVE-2026-81501/"
}
],
"title": "incus-7.4-1.1 on GA media",
"tracking": {
"current_release_date": "2026-09-17T17:22:13Z",
"generator": {
"date": "2026-08-31T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:11651-1",
"initial_release_date": "2026-08-31T00:00:00Z",
"revision_history": [
{
"date": "2026-08-31T00:00:00Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-16T20:26:29Z",
"number": "2",
"summary": "unknown changes"
},
{
"date": "2026-09-16T21:28:38Z",
"number": "3",
"summary": "unknown changes"
},
{
"date": "2026-09-17T17:22:13Z",
"number": "4",
"summary": "unknown changes"
}
],
"status": "final",
"version": "4"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "incus-0:7.4-1.1.aarch64",
"product": {
"name": "incus-0:7.4-1.1.aarch64",
"product_id": "incus-0:7.4-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:linuxcontainers:incus:7.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/incus@7.4-1.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "incus-cli-0:7.4-1.1.aarch64",
"product": {
"name": "incus-cli-0:7.4-1.1.aarch64",
"product_id": "incus-cli-0:7.4-1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/incus-cli@7.4-1.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "incus-cli-bash-completion-0:7.4-1.1.aarch64",
"product": {
"name": "incus-cli-bash-completion-0:7.4-1.1.aarch64",
"product_id": "incus-cli-bash-completion-0:7.4-1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/incus-cli-bash-completion@7.4-1.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "incus-cli-fish-completion-0:7.4-1.1.aarch64",
"product": {
"name": "incus-cli-fish-completion-0:7.4-1.1.aarch64",
"product_id": "incus-cli-fish-completion-0:7.4-1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/incus-cli-fish-completion@7.4-1.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"product": {
"name": "incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"product_id": "incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/incus-cli-zsh-completion@7.4-1.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "incus-tools-0:7.4-1.1.aarch64",
"product": {
"name": "incus-tools-0:7.4-1.1.aarch64",
"product_id": "incus-tools-0:7.4-1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/incus-tools@7.4-1.1?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "incus-0:7.4-1.1.ppc64le",
"product": {
"name": "incus-0:7.4-1.1.ppc64le",
"product_id": "incus-0:7.4-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:linuxcontainers:incus:7.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/incus@7.4-1.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "incus-cli-0:7.4-1.1.ppc64le",
"product": {
"name": "incus-cli-0:7.4-1.1.ppc64le",
"product_id": "incus-cli-0:7.4-1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/suse/incus-cli@7.4-1.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"product": {
"name": "incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"product_id": "incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/suse/incus-cli-bash-completion@7.4-1.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"product": {
"name": "incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"product_id": "incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/suse/incus-cli-fish-completion@7.4-1.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"product": {
"name": "incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"product_id": "incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/suse/incus-cli-zsh-completion@7.4-1.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "incus-tools-0:7.4-1.1.ppc64le",
"product": {
"name": "incus-tools-0:7.4-1.1.ppc64le",
"product_id": "incus-tools-0:7.4-1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/suse/incus-tools@7.4-1.1?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "incus-0:7.4-1.1.s390x",
"product": {
"name": "incus-0:7.4-1.1.s390x",
"product_id": "incus-0:7.4-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:linuxcontainers:incus:7.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/incus@7.4-1.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "incus-cli-0:7.4-1.1.s390x",
"product": {
"name": "incus-cli-0:7.4-1.1.s390x",
"product_id": "incus-cli-0:7.4-1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/incus-cli@7.4-1.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "incus-cli-bash-completion-0:7.4-1.1.s390x",
"product": {
"name": "incus-cli-bash-completion-0:7.4-1.1.s390x",
"product_id": "incus-cli-bash-completion-0:7.4-1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/incus-cli-bash-completion@7.4-1.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "incus-cli-fish-completion-0:7.4-1.1.s390x",
"product": {
"name": "incus-cli-fish-completion-0:7.4-1.1.s390x",
"product_id": "incus-cli-fish-completion-0:7.4-1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/incus-cli-fish-completion@7.4-1.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "incus-cli-zsh-completion-0:7.4-1.1.s390x",
"product": {
"name": "incus-cli-zsh-completion-0:7.4-1.1.s390x",
"product_id": "incus-cli-zsh-completion-0:7.4-1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/incus-cli-zsh-completion@7.4-1.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "incus-tools-0:7.4-1.1.s390x",
"product": {
"name": "incus-tools-0:7.4-1.1.s390x",
"product_id": "incus-tools-0:7.4-1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/incus-tools@7.4-1.1?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "incus-0:7.4-1.1.x86_64",
"product": {
"name": "incus-0:7.4-1.1.x86_64",
"product_id": "incus-0:7.4-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:linuxcontainers:incus:7.4:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/incus@7.4-1.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "incus-cli-0:7.4-1.1.x86_64",
"product": {
"name": "incus-cli-0:7.4-1.1.x86_64",
"product_id": "incus-cli-0:7.4-1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/incus-cli@7.4-1.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "incus-cli-bash-completion-0:7.4-1.1.x86_64",
"product": {
"name": "incus-cli-bash-completion-0:7.4-1.1.x86_64",
"product_id": "incus-cli-bash-completion-0:7.4-1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/incus-cli-bash-completion@7.4-1.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "incus-cli-fish-completion-0:7.4-1.1.x86_64",
"product": {
"name": "incus-cli-fish-completion-0:7.4-1.1.x86_64",
"product_id": "incus-cli-fish-completion-0:7.4-1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/incus-cli-fish-completion@7.4-1.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"product": {
"name": "incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"product_id": "incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/incus-cli-zsh-completion@7.4-1.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "incus-tools-0:7.4-1.1.x86_64",
"product": {
"name": "incus-tools-0:7.4-1.1.x86_64",
"product_id": "incus-tools-0:7.4-1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/incus-tools@7.4-1.1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "incus-0:7.4-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64"
},
"product_reference": "incus-0:7.4-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "incus-0:7.4-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le"
},
"product_reference": "incus-0:7.4-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "incus-0:7.4-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:incus-0:7.4-1.1.s390x"
},
"product_reference": "incus-0:7.4-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "incus-0:7.4-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64"
},
"product_reference": "incus-0:7.4-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "incus-cli-0:7.4-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64"
},
"product_reference": "incus-cli-0:7.4-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "incus-cli-0:7.4-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le"
},
"product_reference": "incus-cli-0:7.4-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "incus-cli-0:7.4-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x"
},
"product_reference": "incus-cli-0:7.4-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "incus-cli-0:7.4-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64"
},
"product_reference": "incus-cli-0:7.4-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "incus-cli-bash-completion-0:7.4-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64"
},
"product_reference": "incus-cli-bash-completion-0:7.4-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "incus-cli-bash-completion-0:7.4-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le"
},
"product_reference": "incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "incus-cli-bash-completion-0:7.4-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x"
},
"product_reference": "incus-cli-bash-completion-0:7.4-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "incus-cli-bash-completion-0:7.4-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64"
},
"product_reference": "incus-cli-bash-completion-0:7.4-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "incus-cli-fish-completion-0:7.4-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64"
},
"product_reference": "incus-cli-fish-completion-0:7.4-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "incus-cli-fish-completion-0:7.4-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le"
},
"product_reference": "incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "incus-cli-fish-completion-0:7.4-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x"
},
"product_reference": "incus-cli-fish-completion-0:7.4-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "incus-cli-fish-completion-0:7.4-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64"
},
"product_reference": "incus-cli-fish-completion-0:7.4-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "incus-cli-zsh-completion-0:7.4-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64"
},
"product_reference": "incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "incus-cli-zsh-completion-0:7.4-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le"
},
"product_reference": "incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "incus-cli-zsh-completion-0:7.4-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x"
},
"product_reference": "incus-cli-zsh-completion-0:7.4-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "incus-cli-zsh-completion-0:7.4-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64"
},
"product_reference": "incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "incus-tools-0:7.4-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64"
},
"product_reference": "incus-tools-0:7.4-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "incus-tools-0:7.4-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le"
},
"product_reference": "incus-tools-0:7.4-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "incus-tools-0:7.4-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x"
},
"product_reference": "incus-tools-0:7.4-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "incus-tools-0:7.4-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
},
"product_reference": "incus-tools-0:7.4-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-39402",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39402"
}
],
"notes": [
{
"category": "general",
"text": "lxc is a Linux container runtime. In the setuid helper lxc-user-nic, the delete path contains a logic flaw in the find_line() function that allows an unprivileged user to delete OVS-attached network interfaces belonging to other users. When lxc-user-nic delete scans its NIC database to authorize a deletion request, the interface name comparison can set the authorization flag based on a name match alone, even when the ownership, type, and link fields in that database entry belong to a different user. The vulnerable check sits after the goto next label handling, meaning it is reachable on lines where earlier ownership checks failed or were skipped. Because nothing downstream of this authorization signal re-verifies that the matched database line actually belongs to the caller, an unprivileged attacker with a valid lxc-usernet policy entry can trigger deletion of another user\u0027s OVS port on the same bridge. \n\nThis is limited to multi-tenant environments using lxc-user-nic with OpenVSwitch bridges. The impact is denial of service - one tenant can repeatedly disconnect networking from containers run by another tenant on shared infrastructure. This is patched in version 7.0.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39402",
"url": "https://www.suse.com/security/cve/CVE-2026-39402"
},
{
"category": "external",
"summary": "SUSE Bug 1264268 for CVE-2026-39402",
"url": "https://bugzilla.suse.com/1264268"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-31T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-39402"
},
{
"cve": "CVE-2026-47753",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-47753"
}
],
"notes": [
{
"category": "general",
"text": "Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateInstanceFromBackup` in `internal/server/storage/backend.go` contains a nil-pointer dereference that an authenticated user with permission to create instances in any project can trigger remotely by uploading a crafted backup tarball. The Incus daemon panics and the process crashes, causing denial of service to every project on that cluster member. This is a sibling of `GHSA-fwj8-62r8-8p8m`, `GHSA-r7w7-mmxr-47r9`, and `GHSA-x5r6-jr56-89pv` (all assigned 2026-05-04). Those patches added guards on adjacent fields of the same `backup/config.Config` struct; the `Volume` field on the instance-import path was missed. Version 7.1.0 contains an updated patch.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-47753",
"url": "https://www.suse.com/security/cve/CVE-2026-47753"
},
{
"category": "external",
"summary": "SUSE Bug 1268383 for CVE-2026-47753",
"url": "https://bugzilla.suse.com/1268383"
},
{
"category": "external",
"summary": "SUSE Bug 1269551 for CVE-2026-47753",
"url": "https://bugzilla.suse.com/1269551"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-31T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-47753"
},
{
"cve": "CVE-2026-48749",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-48749"
}
],
"notes": [
{
"category": "general",
"text": "Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 fixes the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-48749",
"url": "https://www.suse.com/security/cve/CVE-2026-48749"
},
{
"category": "external",
"summary": "SUSE Bug 1269543 for CVE-2026-48749",
"url": "https://bugzilla.suse.com/1269543"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-31T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2026-48749"
},
{
"cve": "CVE-2026-48750",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-48750"
}
],
"notes": [
{
"category": "general",
"text": "Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output` parameter of the `/instances/$name/exec` endpoint stores the output of the command in the `exec-output` directory of the instance. If `exec-output` is a symlink, file named `exec_UUID.stdout` and `exec_UUID.stderr` can be written to an arbitrary location where the `.stdout` file will contain arbitrary content. This behavior can be abused for arbitrary command execution. Version 7.2.0 contains a patch.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-48750",
"url": "https://www.suse.com/security/cve/CVE-2026-48750"
},
{
"category": "external",
"summary": "SUSE Bug 1269547 for CVE-2026-48750",
"url": "https://bugzilla.suse.com/1269547"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-31T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2026-48750"
},
{
"cve": "CVE-2026-48751",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-48751"
}
],
"notes": [
{
"category": "general",
"text": "Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as `raw.lxc` and `raw.qemu`. Version 7.2.0 patches the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-48751",
"url": "https://www.suse.com/security/cve/CVE-2026-48751"
},
{
"category": "external",
"summary": "SUSE Bug 1269535 for CVE-2026-48751",
"url": "https://bugzilla.suse.com/1269535"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-31T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2026-48751"
},
{
"cve": "CVE-2026-48752",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-48752"
}
],
"notes": [
{
"category": "general",
"text": "Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 patches the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-48752",
"url": "https://www.suse.com/security/cve/CVE-2026-48752"
},
{
"category": "external",
"summary": "SUSE Bug 1269507 for CVE-2026-48752",
"url": "https://bugzilla.suse.com/1269507"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-31T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2026-48752"
},
{
"cve": "CVE-2026-48753",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-48753"
}
],
"notes": [
{
"category": "general",
"text": "Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-48753",
"url": "https://www.suse.com/security/cve/CVE-2026-48753"
},
{
"category": "external",
"summary": "SUSE Bug 1269541 for CVE-2026-48753",
"url": "https://bugzilla.suse.com/1269541"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-31T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2026-48753"
},
{
"cve": "CVE-2026-48754",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-48754"
}
],
"notes": [
{
"category": "general",
"text": "Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).createDependentVolumesFromBackup` in `internal/server/storage/backend.go` contains a cluster of unguarded pointer derefs on every dependent-volume entry\u0027s `VolumeSnapshots[i]`, `Volume`, and `Pool` sub-fields. An authenticated user with `can_create_instances` permission on any project can crash the `incusd` daemon by uploading an instance backup tarball whose `dependent_volumes[*]` block contains a nil snapshot pointer (or omits `volume:` / `pool:`). This is a sibling-field variant of the 2026-05-04 batch fix `d768f81c0a1d985f35ae56219519822b080bf5e3` (\"Properly check dependent volumes on import\"). That commit added `if disk == nil` at the top of the outer loop, but did not guard the four sub-pointer fields the loop body dereferences naked. Version 7.1.0 contains an updated patch.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-48754",
"url": "https://www.suse.com/security/cve/CVE-2026-48754"
},
{
"category": "external",
"summary": "SUSE Bug 1269551 for CVE-2026-48754",
"url": "https://bugzilla.suse.com/1269551"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-31T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-48754"
},
{
"cve": "CVE-2026-48755",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-48755"
}
],
"notes": [
{
"category": "general",
"text": "Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-48755",
"url": "https://www.suse.com/security/cve/CVE-2026-48755"
},
{
"category": "external",
"summary": "SUSE Bug 1269508 for CVE-2026-48755",
"url": "https://bugzilla.suse.com/1269508"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-31T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2026-48755"
},
{
"cve": "CVE-2026-48756",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-48756"
}
],
"notes": [
{
"category": "general",
"text": "Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateCustomVolumeFromBackup` in `internal/server/storage/backend.go` contains an unguarded `*time.Time` dereference on the `ExpiresAt` field of every volume-snapshot entry in an imported custom-volume backup. An authenticated user with `can_create_storage_volumes` permission on any project can crash the `incusd` daemon by uploading a backup tarball whose `volume_snapshots[*].expires_at` field is absent. This is a sibling-field variant of GHSA-r7w7-mmxr-47r9 (CVE-2026-40197). Commit `985a1dedf9f3e7ba729c93b654905ed510de25c2` added `if s == nil` at the top of the loop body, but did not guard the adjacent `*snapshot.ExpiresAt` deref 19 lines later. Every other consumer of `Config.VolumeSnapshots[i].ExpiresAt` in this same file already gates the deref with a nil-check - the asymmetric guard is the bug. Version 7.1.0 contains an updated patch.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-48756",
"url": "https://www.suse.com/security/cve/CVE-2026-48756"
},
{
"category": "external",
"summary": "SUSE Bug 1269548 for CVE-2026-48756",
"url": "https://bugzilla.suse.com/1269548"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-31T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-48756"
},
{
"cve": "CVE-2026-48769",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-48769"
}
],
"notes": [
{
"category": "general",
"text": "Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-48769",
"url": "https://www.suse.com/security/cve/CVE-2026-48769"
},
{
"category": "external",
"summary": "SUSE Bug 1269552 for CVE-2026-48769",
"url": "https://bugzilla.suse.com/1269552"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-31T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2026-48769"
},
{
"cve": "CVE-2026-55621",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-55621"
}
],
"notes": [
{
"category": "general",
"text": "Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don\u0027t have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to access secrets in custom volumes they are not authorized to access. Version 7.2.0 patches the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-55621",
"url": "https://www.suse.com/security/cve/CVE-2026-55621"
},
{
"category": "external",
"summary": "SUSE Bug 1276243 for CVE-2026-55621",
"url": "https://bugzilla.suse.com/1276243"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-31T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-55621"
},
{
"cve": "CVE-2026-55622",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-55622"
}
],
"notes": [
{
"category": "general",
"text": "Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don\u0027t have access to and the name of an instance in that project can copy the instance to a new project. This issue could allow an attacker to access secrets in instances they are not authorized to access. Version 7.2.0 patches the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-55622",
"url": "https://www.suse.com/security/cve/CVE-2026-55622"
},
{
"category": "external",
"summary": "SUSE Bug 1276242 for CVE-2026-55622",
"url": "https://bugzilla.suse.com/1276242"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-31T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-55622"
},
{
"cve": "CVE-2026-62313",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-62313"
}
],
"notes": [
{
"category": "general",
"text": "Incus is a system container and virtual machine manager. Prior to version 7.3.0, project-level enforcement of `restricted.containers.privilege=isolated` can be trivially bypassed, allowing a user to create a non-isolated (shared host idmap) container in a project that is configured to forbid them. The restriction only rejects an explicitly set `security.idmap.isolated=false` (or empty) and fails to enforce anything when the key is omitted entirely. Because an unset `security.idmap.isolated` defaults to `false` (non-isolation), a user simply leaves the key out and obtains exactly the container state the restriction is meant to forbid. This defeats the tenant-isolation guarantee the restriction exists to provide. Containers in the project share the host uid/gid map instead of receiving unique, non-overlapping ranges, weakening the isolation boundary between co-tenant containers and the host. Version 7.3.0 patches the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-62313",
"url": "https://www.suse.com/security/cve/CVE-2026-62313"
},
{
"category": "external",
"summary": "SUSE Bug 1276244 for CVE-2026-62313",
"url": "https://bugzilla.suse.com/1276244"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-31T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-62313"
},
{
"cve": "CVE-2026-62867",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-62867"
}
],
"notes": [
{
"category": "general",
"text": "Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided `block.create_options` in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject arbitrary arguments into the binary executed as root. Version 7.3.0 patches the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-62867",
"url": "https://www.suse.com/security/cve/CVE-2026-62867"
},
{
"category": "external",
"summary": "SUSE Bug 1276246 for CVE-2026-62867",
"url": "https://bugzilla.suse.com/1276246"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-31T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2026-62867"
},
{
"cve": "CVE-2026-62940",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-62940"
}
],
"notes": [
{
"category": "general",
"text": "Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configuration overrides (including security-critical keys like `security.privileged` and `raw.lxc`) are applied without any project restriction enforcement, allowing a restricted project user to escalate to a privileged container and escape to the host. Version 7.3.0 patches the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-62940",
"url": "https://www.suse.com/security/cve/CVE-2026-62940"
},
{
"category": "external",
"summary": "SUSE Bug 1276247 for CVE-2026-62940",
"url": "https://bugzilla.suse.com/1276247"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-31T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2026-62940"
},
{
"cve": "CVE-2026-62941",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-62941"
}
],
"notes": [
{
"category": "general",
"text": "Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check (`AllowInstanceCreation`) runs BEFORE the source instance\u0027s configuration is merged into the request. Dangerous configuration keys (including `security.privileged`, `raw.lxc`, `raw.apparmor`) from the source instance are merged AFTER the check passes, bypassing all project restrictions on the target project. Version 7.3.0 patches the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-62941",
"url": "https://www.suse.com/security/cve/CVE-2026-62941"
},
{
"category": "external",
"summary": "SUSE Bug 1276248 for CVE-2026-62941",
"url": "https://bugzilla.suse.com/1276248"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-31T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2026-62941"
},
{
"cve": "CVE-2026-63125",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-63125"
}
],
"notes": [
{
"category": "general",
"text": "Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user (a non-admin TLS/RBAC identity with `can_create_images` and `can_create_instances`) can execute arbitrary code as root on the host. A crafted image ships `backup.yaml` as a symlink to a host file. When the root daemon writes the instance\u0027s backup file, it follows the symlink. Version 7.3.0 patches the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-63125",
"url": "https://www.suse.com/security/cve/CVE-2026-63125"
},
{
"category": "external",
"summary": "SUSE Bug 1276249 for CVE-2026-63125",
"url": "https://bugzilla.suse.com/1276249"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-31T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2026-63125"
},
{
"cve": "CVE-2026-63343",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-63343"
}
],
"notes": [
{
"category": "general",
"text": "Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a `metadata.yaml` symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadata API. The `exec-output` and `templates/` paths were patched in a prior release using `Lstat` rejection and `os.OpenRoot` confinement; `metadata.yaml` was not included in either patch and remains exploitable. Version 7.3.0 patches the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-63343",
"url": "https://www.suse.com/security/cve/CVE-2026-63343"
},
{
"category": "external",
"summary": "SUSE Bug 1276251 for CVE-2026-63343",
"url": "https://bugzilla.suse.com/1276251"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-31T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2026-63343"
},
{
"cve": "CVE-2026-81500",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-81500"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-81500",
"url": "https://www.suse.com/security/cve/CVE-2026-81500"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-31T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-81500"
},
{
"cve": "CVE-2026-81501",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-81501"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-81501",
"url": "https://www.suse.com/security/cve/CVE-2026-81501"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:incus-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-bash-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-fish-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-cli-zsh-completion-0:7.4-1.1.x86_64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.aarch64",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.ppc64le",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.s390x",
"openSUSE Tumbleweed:incus-tools-0:7.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-31T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-81501"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…