Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Incus bug bounty programs

linuxcontainers.org Updated

Incus runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
14
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Incus runs.

  • Incus

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

14 targets. 5 excluded.

  • https://linuxcontainers.org/incus

    Web

  • Authentication and authorisation: TLS client certificates, OIDC, the trust store and the fine-grained permission system

    Products and areas

  • Backup and export, including archive creation, the compression helpers invoked and the restore path

    Products and areas

  • Image handling end to end: import, the trusted-hash path, unpacking, templates and the rootfs contents of any supplied image

    Products and areas

  • Instance configuration for both containers and virtual machines, covering devices, profiles and every value that reaches the runtime beneath

    Products and areas

  • Migration between servers and the state a receiving server accepts from a sending one

    Products and areas

  • Networking: managed bridges, OVN integration, forwards, load balancers and the firewall rules generated on the host

    Products and areas

  • Projects and the restriction model that keeps one project's instances, networks and storage away from another's

    Products and areas

  • The command-line client, since a hostile server or image reaching the operator's workstation is a real class here

    Products and areas

  • The exec, file push and pull, and console paths, where the daemon acts on a path inside a running instance

    Products and areas

  • The guest-facing DevIncus API an instance can reach from inside itself

    Products and areas

  • The Incus daemon and its REST API in full, over the local UNIX socket and over the network listener

    Products and areas

  • The policy accepts security issues by email to the Linux Containers security address or through GitHub advisory reporting, with one declared boundary: privileged container escapes do not qualify because privileged containers are not treated as root-safe, while unprivileged container escapes do

    Products and areas

  • The storage drivers (ZFS, btrfs, LVM, Ceph and dir) with their volume, snapshot and custom-volume handling

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 5

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Defects in LXC or LXCFS beneath Incus, which the same project handles under its own security page

  • Escapes from privileged containers, ruled out by name in the policy

  • Kernel bugs reachable from a container, which belong to the kernel's own process

  • Operator configuration that deliberately removes isolation, such as running an instance privileged on purpose or attaching a host device

  • QEMU defects in the virtual-machine path rather than Incus's configuration of them

Recent changes

Reward and scope changes across every Incus program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Incus products, from the NVD.

Search NVD
  • CVE-2026-41685 Medium

    Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads of large amount of data by authenticated users can run the Incus server out of disk space, potentially taking down the host system. The impact here is limited for anyone using storage.images_volume and storage.backups_volume as those users will have large uploads be stored on those volumes rather than directly

  • CVE-2026-41647 Medium

    Incus is a system container and virtual machine manager. Prior to version 7.0.0, a missing error handling could lead an authenticated Incus user to cause a daemon crash through the import of a truncated storage bucket backup file. This issue has been patched in version 7.0.0.

  • CVE-2026-41648 Medium

    Incus is a system container and virtual machine manager. Prior to version 7.0.0, user provided image and backup tarballs would be unpacked and YAML files parsed without any size restrictions. This was making it easy for an authenticated user to provide a crafted image or backup tarball that when parsed by Incus would lead to a very large YAML document being loaded into memory, potentially causing

  • CVE-2026-41684 Medium

    Incus is a system container and virtual machine manager. Prior to version 7.0.0, backup.GetInfo() trusts the inline backup/index.yaml config when present and only falls back to parsing the legacy backup/container/backup.yaml file if result.Config == nil. As a result, an archive can carry a valid inline config that passes the initial import preflight while also carrying a malformed legacy backup/co

  • CVE-2026-40195 High

    Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage bucket import logic allows an authenticated user with access to the storage bucket feature to cause the Incus daemon to crash. The vulnerability is present in the backup metadata handling logic, where the daemon processes the index.yaml file from an imported archive and access

  • CVE-2026-40197 High

    Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authenticated user with access to the storage volume feature to cause the Incus daemon to crash. The custom volume backup import subsystem contains a nil-pointer dereference vulnerability during import operations. In the snapshot import loop, the

  • CVE-2026-40243 Low

    Incus is a system container and virtual machine manager. In versions before 7.0.0, broken TLS validation logic in the OVN database connection logic can allow connections to an attacker's OVN database. The OVN client implementations disable Go standard TLS server verification and replace it with custom peer-certificate verification logic. That replacement verifier does not anchor trust in the confi

  • CVE-2026-40251 High

    Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authenticated user with access to the storage volume feature to cause the Incus daemon to crash. The backup restore subsystem contains an out-of-bounds panic vulnerability caused by an invalid bounds check when indexing snapshot metadata arrays, a

About this page

This page gathers every public program listed under linuxcontainers.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.