3.4
Low
CVE-2025-52889 Incus is a system container and virtual machine manager
Description
Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus version 6.12 and 6.13 generates nftables rules for local services (DHCP, DNS...) that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to DHCP pool exhaustion and opens the door for other attacks. A patch is available at commit 2516fb19ad8428454cb4edfe70c0a5f0dc1da214.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| incus 6.12 | 6.12 → 6.13 | No fix stated |
Other CVEs of incus
The 47 CVEs of incus →
CVE-2026-115378
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in…
6.9
Medium
CVE-2026-115377
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that…
9.4
Critical
CVE-2026-115376
Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows…
8.3
High
CVE-2026-115375
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes
9.4
Critical