- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 14
- Public CVEs
- 32
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
14 assets you may test, 5 excluded.
Web 1
- https://linuxcontainers.org/incus
Products and areas 13
- Authentication and authorisation: TLS client certificates, OIDC, the trust store and the fine-grained permission system
- Backup and export, including archive creation, the compression helpers invoked and the restore path
- Image handling end to end: import, the trusted-hash path, unpacking, templates and the rootfs contents of any supplied image
- Instance configuration for both containers and virtual machines, covering devices, profiles and every value that reaches the runtime beneath
- Migration between servers and the state a receiving server accepts from a sending one
- Networking: managed bridges, OVN integration, forwards, load balancers and the firewall rules generated on the host
- Projects and the restriction model that keeps one project's instances, networks and storage away from another's
- The command-line client, since a hostile server or image reaching the operator's workstation is a real class here
- The exec, file push and pull, and console paths, where the daemon acts on a path inside a running instance
- The guest-facing DevIncus API an instance can reach from inside itself
- The Incus daemon and its REST API in full, over the local UNIX socket and over the network listener
- The policy accepts security issues by email to the Linux Containers security address or through GitHub advisory reporting, with one declared boundary: privileged container escapes do not qualify because privileged containers are not treated as root-safe, while unprivileged container escapes do
- The storage drivers (ZFS, btrfs, LVM, Ceph and dir) with their volume, snapshot and custom-volume handling
Out of scope (5)
- Defects in LXC or LXCFS beneath Incus, which the same project handles under its own security page
- Escapes from privileged containers, ruled out by name in the policy
- Kernel bugs reachable from a container, which belong to the kernel's own process
- Operator configuration that deliberately removes isolation, such as running an instance privileged on purpose or attaching a host device
- QEMU defects in the virtual-machine path rather than Incus's configuration of them
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Report privately by email to the address on the policy page , or through GitHub private advisory reporting on lxc/incus. The policy names both
-
Privileged container escapes do not qualify. The policy states that privileged containers are not considered root safe, so demonstrate against an unprivileged container
-
Unprivileged container escapes do qualify and are stated as such, so make the privilege mode explicit in the report
-
Incus is the community fork, distinct from Canonical's LXD. Findings that only reproduce on LXD belong at canonical/lxd even though the codebases share heritage
-
Say whether the target was a container or a virtual machine. The two share the daemon but diverge completely below it
-
Give the exact version and the storage driver in use. Much of the 2026 record turns on storage and image handling specifics
Not accepted
-
Escapes from privileged containers, ruled out by name in the policy
-
Defects in LXC or LXCFS beneath Incus
-
QEMU defects in the virtual-machine path rather than Incus's configuration of them
-
Kernel bugs reachable from a container
-
Operator configuration that deliberately removes isolation
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-41685 | Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads of large amount of data by authenticated users can run the Incus server out of disk space, potentially taking down the host system. The impact here is limited for anyone using storage.images_volume and storage.backups_volume as those users will have large uploads be stored on those volumes rather than directly | Medium 4.3 | 7 May 2026 |
| CVE-2026-41647 | Incus is a system container and virtual machine manager. Prior to version 7.0.0, a missing error handling could lead an authenticated Incus user to cause a daemon crash through the import of a truncated storage bucket backup file. This issue has been patched in version 7.0.0. | Medium 6.5 | 7 May 2026 |
| CVE-2026-41648 | Incus is a system container and virtual machine manager. Prior to version 7.0.0, user provided image and backup tarballs would be unpacked and YAML files parsed without any size restrictions. This was making it easy for an authenticated user to provide a crafted image or backup tarball that when parsed by Incus would lead to a very large YAML document being loaded into memory, potentially causing | Medium 5.3 | 7 May 2026 |
| CVE-2026-41684 | Incus is a system container and virtual machine manager. Prior to version 7.0.0, backup.GetInfo() trusts the inline backup/index.yaml config when present and only falls back to parsing the legacy backup/container/backup.yaml file if result.Config == nil. As a result, an archive can carry a valid inline config that passes the initial import preflight while also carrying a malformed legacy backup/co | Medium 6.5 | 7 May 2026 |
| CVE-2026-40195 | Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage bucket import logic allows an authenticated user with access to the storage bucket feature to cause the Incus daemon to crash. The vulnerability is present in the backup metadata handling logic, where the daemon processes the index.yaml file from an imported archive and access | High 7.1 | 6 May 2026 |
| CVE-2026-40197 | Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authenticated user with access to the storage volume feature to cause the Incus daemon to crash. The custom volume backup import subsystem contains a nil-pointer dereference vulnerability during import operations. In the snapshot import loop, the | High 7.1 | 6 May 2026 |
| CVE-2026-40243 | Incus is a system container and virtual machine manager. In versions before 7.0.0, broken TLS validation logic in the OVN database connection logic can allow connections to an attacker's OVN database. The OVN client implementations disable Go standard TLS server verification and replace it with custom peer-certificate verification logic. That replacement verifier does not anchor trust in the confi | Low 2.3 | 6 May 2026 |
| CVE-2026-40251 | Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authenticated user with access to the storage volume feature to cause the Incus daemon to crash. The backup restore subsystem contains an out-of-bounds panic vulnerability caused by an invalid bounds check when indexing snapshot metadata arrays, a | High 7.1 | 6 May 2026 |
| CVE-2026-39402 | lxc is a Linux container runtime. In the setuid helper lxc-user-nic, the delete path contains a logic flaw in the find_line() function that allows an unprivileged user to delete OVS-attached network interfaces belonging to other users. When lxc-user-nic delete scans its NIC database to authorize a deletion request, the interface name comparison can set the authorization flag based on a name match | Medium 4.3 | 5 May 2026 |
| CVE-2026-35527 | Incus is an open source container and virtual machine manager. In versions prior to 7.0.0, the image import flow issues an outbound HEAD request to a user-supplied URL before validating the request against project restrictions such as restricted.images.servers. The imgPostURLInfo function constructs and sends a HEAD request directly from the attacker-supplied source URL to resolve image metadata, | Medium 5.3 | 5 May 2026 |
| CVE-2026-33945 | Incus is a system container and virtual machine manager. Incus instances have an option to provide credentials to systemd in the guest. For containers, this is handled through a shared directory. Prior to version 6.23.0, an attacker can set a configuration key named something like `systemd.credential.../../../../../../root/.bashrc` to cause Incus to write outside of the `credentials` directory ass | Critical 9.9 | 27 Mar 2026 |
| CVE-2026-33898 | Incus is a system container and virtual machine manager. Prior to version 6.23.0, the web server spawned by `incus webui` incorrectly validates the authentication token such that an invalid value will be accepted. `incus webui` runs a local web server on a random localhost port. For authentication, it provides the user with a URL containing an authentication token. When accessed with that token, I | High 8.8 | 27 Mar 2026 |
| CVE-2026-33743 | Incus is a system container and virtual machine manager. Prior to version 6.23.0, a specially crafted storage bucket backup can be used by an user with access to Incus' storage bucket feature to crash the Incus daemon. Repeated use of this attack can be used to keep the server offline causing a denial of service of the control plane API. This does not impact any running workload, existing containe | Medium 6.5 | 26 Mar 2026 |
| CVE-2026-33897 | Incus is a system container and virtual machine manager. Prior to version 6.23.0, instance template files can be used to cause arbitrary read or writes as root on the host server. Incus allows for pongo2 templates within instances which can be used at various times in the instance lifecycle to template files inside of the instance. This particular implementation of pongo2 within Incus allowed for | Critical 9.9 | 26 Mar 2026 |
| CVE-2026-33542 | Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from simplestreams image servers opens the door to image cache poisoning and under very narrow circumstances exposes other tenants to running attacker controlled images rather than the expected one. Version 6.23.0 patches the issue. | Medium 5.7 | 26 Mar 2026 |
| CVE-2026-33711 | Incus is a system container and virtual machine manager. Incus provides an API to retrieve VM screenshots. That API relies on the use of a temporary file for QEMU to write the screenshot to which is then picked up and sent to the user prior to deletion. As versions prior to 6.23.0 use predictable paths under /tmp for this, an attacker with local access to the system can abuse this mechanism by cre | Medium 4.7 | 26 Mar 2026 |
| CVE-2026-23953 | Incus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch a container with a custom YAML configuration (e.g a member of the ‘incus’ group) can create an environment variable containing newlines, which can be used to add additional configuration items in the container’s lxc.conf due to newline injection. This can allow adding arbitrary | High 8.7 | 22 Jan 2026 |
| CVE-2026-23954 | Incus is a system container and virtual machine manager. Versions 6.21.0 and below allow a user with the ability to launch a container with a custom image (e.g a member of the ‘incus’ group) to use directory traversal or symbolic links in the templating functionality to achieve host arbitrary file read, and host arbitrary file write. This ultimately results in arbitrary command execution on the ho | High 8.7 | 22 Jan 2026 |
| CVE-2025-64507 | Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.19.0 affects any Incus user in an environment where an unprivileged user may have root access to a container with an attached custom storage volume that has the `security.shifted` property set to `true` as well as access to the host as an unprivileged user. The most common case for this would be syst | High 8.6 | 10 Nov 2025 |
| CVE-2022-47952 | lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protected directory tree, because "Failed to open" often indicates that a file does not exist, whereas "does not refer to a network namespace path" often indicates that a file exists. NOTE: this is different from CVE-2018-6556 because the CVE-2018-6556 fix design wa | Low 3.3 | 1 Jan 2023 |
| CVE-2017-18641 | In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature check, before running it to bootstrap containers. | High 8.1 | 10 Feb 2020 |
| CVE-2015-1340 | LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice. | High 7.0 | 22 Apr 2019 |
| CVE-2019-5736 | runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, | High 8.6 | 11 Feb 2019 |
| CVE-2018-6556 | lxc-user-nic when asked to delete a network interface will unconditionally open a user provided path. This code path may be used by an unprivileged user to check for the existence of a path which they wouldn't otherwise be able to reach. It may also be used to trigger side effects by causing a (read-only) open of special kernel files (ptmx, proc, sys). Affected releases are LXC: 2.0 versions above | Low 3.3 | 10 Aug 2018 |
| CVE-2016-8649 | lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's filesystem via the openat() family of syscalls. | Critical 9.1 | 1 May 2017 |
| CVE-2017-5985 | lxc-user-nic in Linux Containers (LXC) allows local users with a lxc-usernet allocation to create network interfaces on the host and choose the name of those interfaces by leveraging lack of netns ownership check. | Low 3.3 | 14 Mar 2017 |
| CVE-2016-10124 | An issue was discovered in Linux Containers (LXC) before 2016-02-22. When executing a program via lxc-attach, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the container. | High 8.6 | 9 Jan 2017 |
| CVE-2015-1335 | lxc-start in lxc before 1.0.8 and 1.1.x before 1.1.4 allows local container administrators to escape AppArmor confinement via a symlink attack on a (1) mount target or (2) bind mount source. | High 7.2 | 1 Oct 2015 |
| CVE-2015-1334 | attach.c in LXC 1.1.2 and earlier uses the proc filesystem in a container, which allows local container users to escape AppArmor or SELinux confinement by mounting a proc filesystem with a crafted (1) AppArmor profile or (2) SELinux label. | Medium 4.6 | 12 Aug 2015 |
| CVE-2015-1331 | lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/*. | Medium 4.9 | 12 Aug 2015 |
| CVE-2014-1425 | cmanager 0.32 does not properly enforce nesting when modifying cgroup properties, which allows local users to set cgroup values for all cgroups via unspecified vectors. | Low 2.1 | 7 Jan 2015 |
| CVE-2013-6441 | The lxc-sshd template (templates/lxc-sshd.in) in LXC before 1.0.0.beta2 uses read-write permissions when mounting /sbin/init, which allows local users to gain privileges by modifying the init file. | High 7.2 | 14 Feb 2014 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 30 Last 12 months 32 Lifetime Arbitrary file read/write 40 % Path traversal & symlink 25 % Command/argument injection 20 % Authorization bypass 15 % Latest advisories Loading the feed Overview Incus is the Linux Containers project's fork of LXD, managing system containers and virtual machines on one host. Debian 13 ships it by default and it is packaged across Alpine, Arch, Void and Gentoo, so it has largely displaced LXD outside the Ubuntu world. Thirty of the repository's thirty-two published advisories landed in the last twelve months, and a single batch in June 2026 carried five critical arbitrary host file read and write issues. By raw unpaid advisory volume it is the busiest target in this category. The project has no bounty and no platform programme, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The policy accepts security issues by email to the Linux Containers security address or through GitHub advisory reporting, with one declared boundary: privileged container escapes do not qualify because privileged containers are not treated as root-safe, while unprivileged container escapes do The Incus daemon and its REST API in full, over the local UNIX socket and over the network listener Authentication and authorisation: TLS client certificates, OIDC, the trust store and the fine-grained permission system Projects and the restriction model that keeps one project's instances, networks and storage away from another's Image handling end to end: import, the trusted-hash path, unpacking, templates and the rootfs contents of any supplied image Instance configuration for both containers and virtual machines, covering devices, profiles and every value that reaches the runtime beneath The storage drivers (ZFS, btrfs, LVM, Ceph and dir) with their volume, snapshot and custom-volume handling Backup and export, including archive creation, the compression helpers invoked and the restore path Migration between servers and the state a receiving server accepts from a sending one Networking: managed bridges, OVN integration, forwards, load balancers and the firewall rules generated on the host The exec, file push and pull, and console paths, where the daemon acts on a path inside a running instance The guest-facing DevIncus API an instance can reach from inside itself The command-line client, since a hostile server or image reaching the operator's workstation is a real class here Out of scope Escapes from privileged containers, ruled out by name in the policy Defects in LXC or LXCFS beneath Incus, which the same project handles under its own security page QEMU defects in the virtual-machine path rather than Incus's configuration of them Kernel bugs reachable from a container, which belong to the kernel's own process Operator configuration that deliberately removes isolation, such as running an instance privileged on purpose or attaching a host device Most-valued findings Arbitrary host file read or write driven from an instance or a supplied image. The June 2026 batch is mostly this: CVE-2026-48749 and CVE-2026-48752 walked out of a malicious image through symlinks under rootfs/ and templates/, and CVE-2026-48750 wrote to the host through an exec-output symlink Argument injection into a host-side helper. CVE-2026-48755 reached arbitrary code execution through the arguments built for backup compression Client-side compromise from a hostile server or image. CVE-2026-48769 wrote arbitrary files on the client through a trusted image hash Project restriction bypass, where a user or instance in one project reaches another project's resources. Two cross-project bypasses shipped in the same 2026 batch Path traversal in any upload or storage path, the class CVE-2026-48753 hit through S3 multipart upload Unprivileged container escape, which the policy explicitly accepts as a security issue Anything on the DevIncus guest API that lets an instance change its own configuration or observe another instance's Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report privately by email to [email protected] , or through GitHub private advisory reporting on lxc/incus. The policy names both Privileged container escapes do not qualify. The policy states that privileged containers are not considered root safe, so demonstrate against an unprivileged container Unprivileged container escapes do qualify and are stated as such, so make the privilege mode explicit in the report Incus is the community fork, distinct from Canonical's LXD. Findings that only reproduce on LXD belong at canonical/lxd even though the codebases share heritage Say whether the target was a container or a virtual machine. The two share the daemon but diverge completely below it Several 2026 findings hit the client rather than the server. If the attack is a hostile server or image compromising the operator's own machine, say so plainly, because it is in scope and easy to misfile Give the exact version and the storage driver in use. Much of the 2026 record turns on storage and image handling specifics Disclosure Coordinated by the Linux Containers security contacts through email or the GitHub private advisory workflow, published as GitHub Security Advisories on lxc/incus with CVE identifiers assigned. The 2026 record shows publication in batches rather than one at a time, with five critical issues released together on 25 June 2026, so plan for your finding to land alongside others in a scheduled security release. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability