A critical authorization bypass vulnerability in LXC Incus allows authenticated users to achieve full host system compromise through malicious instance snapshots.

This vulnerability involves a missing authorization check (CWE-862) where instance snapshots fail to respect the restricted.containers.lowlevel=block configuration. An authenticated attacker can exploit this to trigger lowlevel hooks, such as raw.lxc or raw.qemu, leading to arbitrary command execution on the underlying host.

The potential for arbitrary command execution on the host server represents a total compromise of the virtualization environment. Successful exploitation allows an attacker to bypass container isolation, access sensitive host data, or move laterally within the infrastructure. With a CVSS score of 9.9, this vulnerability poses an extreme risk to confidentiality, integrity, and availability.

Immediate Action: Update the LXC Incus software to version 7.2.0 or later immediately to resolve the authorization flaw.

Proactive Monitoring: Audit Incus configuration logs for unexpected modifications to instance hooks or unauthorized attempts to utilize restricted lowlevel settings.

Compensating Controls: Restrict access to the Incus API and management interface to only trusted administrative accounts to minimize the attack surface for authenticated users.

Public Exploit Available: No

Given the critical nature of this vulnerability and its potential for full host takeover, organizations must prioritize upgrading to version 7.2.0. Failure to patch leaves the host infrastructure vulnerable to any authenticated user capable of defining instance snapshots.