Blind SSRF Vulnerability in Incus Container Manager

CVE-2026-35527

What is CVE-2026-35527?

Incus, an open source container and virtual machine manager, is susceptible to a blind Server-Side Request Forgery (SSRF) vulnerability in versions prior to 7.0.0. The issue arises during the image import process where a HEAD request is sent to a user-defined URL without adequate validation against project restrictions. This occurs before rejection by the import policy, allowing authenticated users to manipulate the server into sending requests to arbitrary addresses. This can lead to leakage of sensitive server metadata via custom headers, exposing crucial information about the host environment to potentially malicious endpoints. Although the actual image download is prevented by policy settings, the implications of this SSRF vulnerability can be significant, enabling attackers to discover internal services and vulnerable cloud metadata endpoints.

References