CVE-2026-81494
No scoreFix available
[GHSA-7fj9-65v4-rp7h: Arbitrary file write on host via image-planted symlinks and oci.dns.* newline injection]
What each source reports
OSVUBUNTU-CVE-2026-81494 No score
[GHSA-7fj9-65v4-rp7h: Arbitrary file write on host via image-planted symlinks and oci.dns.* newline injection]
- Record
UBUNTU-CVE-2026-81494- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
incusDebian:14 |
before 7.0.1-2, plus listed versions 6.0.4-26.0.4-36.0.5-16.0.5-26.0.5-3 Show 27 moreShow less6.0.5-46.0.5-56.0.5-66.0.5-76.0.5-86.0.6-16.0.6-26.0.6-36.14.0-1~exp16.15.0-1~exp16.16.0-1~exp16.17.0-1~exp16.20.0-1~exp16.21.0-1~exp16.22.0-1~exp16.23.0-1~exp17.0.0-17.0.0-1~bpo13+17.0.0-27.0.0-2~bpo13+17.0.0-37.0.0-47.0.0-57.0.0-5~bpo13+17.0.1-17.0.1-1~bpo13+17.0.1-2~bpo13+1 |
7.0.1-2 |
incusUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 0.4-1ubuntu10.5.1-10.5.1-30.6-16.0.0-1 Show 7 moreShow less6.0.0-1ubuntu0.16.0.0-1ubuntu0.26.0.0-1ubuntu0.2+esm16.0.0-1ubuntu0.36.0.0-1ubuntu0.3+esm16.0.0-1ubuntu0.3+esm26.0.0-1ubuntu0.3+esm3 |
None known |
incusUbuntu:26.10 |
All versions, plus listed versions 6.0.5-87.0.1-5 |
None known |
incusUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 6.0.4-26.0.5-86.0.5-8ubuntu0.26.04.1~esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-81494 is a vulnerability with no CVSS score yet in incus, published August 28, 2026. No source lists public exploit code. Fixed in incus 7.0.1-2.