CVE-2026-48749

The CVSS 9.9 on CVE-2026-48749 is technically accurate but obscures a more fundamental problem: Incus's image import pipeline has no trust boundary. The vulnerability lets a specially crafted image achieve arbitrary host filesystem read and write—but the deeper issue is that the entire image import flow treats imported images as trusted internal operations rather than untrusted input. The fix in version 7.2.0 closes the parsing bug without introducing mandatory image signature verification, content trust verification, or any mechanism requiring explicit user trust decisions. That tells you the developer's mental model treats this as an input validation problem, not a trust model problem—which means every future parsing bug in that pipeline carries the same 9.9 potential. This is not an isolated failure. The same pattern has appeared in Docker's archive extraction bugs, runc's path traversal in image handling, and now Incus. The root cause isn't coincidental—it's an economic tradeoff where frictionless image handling is prioritized over trust boundaries, because explicit trust decisions create user friction. The result is image import code written as if it processes a trusted internal format, then shipped with that assumption intact. For defenders, the operational reality is worse than the CVSS score suggests. There are no distinctive forensic artifacts. The exploit looks like normal image import. There is no log entry indicating host filesystem access via malicious image—which means you cannot scope the blast radius. Organizations running pre-7.2.0 should assume any image imported during the exposure window could have been crafted with malicious intent, and every such image in your registry is now a potential time-delayed exploit waiting for a system that hasn't been patched yet. Prioritize: upgrade to 7.2.0 immediately, audit your image registries for any images imported during the vulnerability window (consider rotating secrets if any images may have been compromised), and treat image import as a security boundary that requires trust decisions—because the tooling should have been doing that all along.

Reviewed through automated stages and approved by a human before publication.