CVE-2026-63125

CVE-2026-63125 in Incus gives a project-confined user with minimal RBAC permissions — specifically `can_create_images` and `can_create_instances` — a path to arbitrary host-file write as root. The attack works by embedding a symlink in image metadata that the privileged backup daemon follows during its write operation. Because the daemon runs as root and trusts content associated with a valid instance, the symlink resolves outside the project confinement boundary, enabling the attacker to write anywhere the daemon has access. This is not a permission misconfiguration. The user in question has appropriately scoped rights for someone who should build and launch workloads. The vulnerability lies in a gap between Incus's declarative permission model and its operational trust model: RBAC governs who creates artifacts, but the backup daemon operates on those artifacts' content without equivalent scrutiny. The permission boundary that confinement provides evaporates the moment user-controlled data enters a privileged operation. The symlink-as-attack-vector is analytically significant because it's a single, well-documented filesystem primitive — no chaining, no discovery required. The CVSS 9.9 reflects the resulting primitive correctly, but it measures potential blast radius, not systemic significance. The deeper issue is that Incus harbors two incompatible trust models that were never formally reconciled: a creator-centric model (artifact is trusted because an RBAC-scoped subject created it) and a content-centric model (artifact is trusted because it contains valid instance data). This pattern has appeared before in Libvirt, LXC, and Kubernetes — it's a recurring structural inheritance in container runtimes, not an isolated incident. Upgrade to Incus 7.3.0 immediately — the patch addresses symlink handling in backup.yaml writes. Beyond patching, audit other privileged daemon operations that process user-supplied content: storage migration, live snapshotting, and any API endpoint that handles image optimization or conversion. The question is not whether this CVE is patched, but whether Incus's threat model now explicitly accounts for what happens when RBAC-scoped users control content that privileged operations consume. If the answer is limited to 'patched backup.yaml,' the underlying condition persists.

Reviewed through automated stages and approved by a human before publication.