Changes.Watch~ upgrade verdicts ~
Free digest
Securitysshole: password bypass in Alpine’s OpenSSH

critical vulnerability

Incus has an arbitrary file write on its client due to trusted image hash

Fix availableCritical · CVSS 9.9EPSS 0.73%

Published Jun 26, 2026 · updated Nov 5, 2026

What to do

  1. Upgrade to a fixed version: github.com/lxc/incus/v7/cmd/incusd 7.2.0.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Gogithub.com/lxc/incus/v7/cmd/incusd

Vulnerable versions
< 7.2.0
Fixed in
7.2.0

Check your project: go list -m all | grep github.com/lxc/incus/v7/cmd/incusd

Sources

CWE-20 Improper Input Validation

← All critical vulnerabilities