CVE-2026-35527 is a blind server-side request forgery (SSRF) vulnerability in Incus prior to version 7.0.0. It allows an authenticated user to cause the Incus daemon to send HEAD requests to arbitrary URLs during the image import preflight stage before validation and policy checks are completed. Although the actual image import is rejected by project restrictions, the premature HEAD request can be used to probe internal or external network endpoints, potentially revealing sensitive environment details.