CVE-2025-52890
High
Description
Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus versions 6.12 and 6.13generates nftables rules that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to ARP spoofing on the bridge and to fully spoof another VM/container on the same bridge. Commit 254dfd2483ab8de39b47c2258b7f1cf0759231c8 contains a patch for the issue.
SeverityHigh
CVSS8.1
Exploit probability—
ProductGithub.com/lxc/incus/v6
PublishedJun 25, 2025
First seenJun 25, 2025
Weakness typeCWE-863Incorrect authorization
How to fix
Update
- github.com/lxc/incus/v66.14.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/lxc/incus/v6Go | 6.12.0 ≤ v < 6.14.0 | 6.14.0 |
| github.com/lxc/incusGo | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.