Announcing Incus 7.2

The Incus team is pleased to announce the release of Incus 7.2!

It’s another pretty busy release for us with a varied set of new features across the board as well as the usual set of performance improvements and bugfixes.

This fixes the following security issues:

• CVE-2026-48749 (critical) – Arbitrary file read+write on host via rootfs/ symlink in malicious image
• CVE-2026-48750 (critical) – Arbitrary file write on host via exec-output symlink in crafted image
• CVE-2026-48751 (critical) – Restricted project bypass leading to arbitrary command execution
• CVE-2026-48752 (critical) – Arbitrary file read+write on host via templates/ symlink in malicious image
• CVE-2026-48755 (critical) – Argument injection in backup compression algorithm leading to arbitrary file write and command execution
• CVE-2026-48769 (critical) – Arbitrary file write on client due to trusted image hash
• CVE-2026-55621 (high) – Project restriction bypass for custom volume copy across projects
• CVE-2026-55622 (high) – Project restriction bypass in instance copy across projects

On the feature front, the highlights for this release are:

• Per-instance SELinux integration
• New incus default CLI command
• Filtered server info by default
• Keepalive timeout from the CLI
• Better OS-specific handling of CLI configuration
• Standalone server certificate update
• Static network configuration for OCI containers
• Per-instance BGP route advertisement
• Dynamic addresses in proxy NAT mode
• Expanded NBD access to VMs
• Btrfs compression for storage volumes
• InfiniBand SR-IOV GUID configuration
• Websocket origin restriction

The full announcement and changelog can be found here.
And for those who prefer videos, here’s the release overview video:

You can take the latest release of Incus up for a spin through our online demo service at: https://linuxcontainers.org/incus/try-it/

And as always, my company is offering commercial support on Incus, ranging from by-the-hour support contracts to one-off services on things like initial migration from LXD, review of your deployment to squeeze the most out of Incus or even feature sponsorship. You’ll find all details of that here: https://zabbly.com/incus

Donations towards my work on this and other open source projects is also always appreciated, you can find me on Github Sponsors, Patreon and Ko-fi.

Enjoy!