Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.0

Incus lets limited users execute commands as root

CVE-2026-115372 · published 1 day ago
Summary

Incus versions from 7.3.0 up to, but not including, 7.5.0 let users who should have restricted access change volume settings in a way that can cause the system to run administrative commands. This could let an attacker gain higher privileges on the host. Update Incus to version 7.5.0 or newer to close the gap.

What to do
  • Update debian incus to version 6.0.4-2+deb13u11.
  • Update debian incus to version 7.0.1-5.
  • Update lxc incus to version 7.5.0 or later.
Affected software
Ecosystem VendorProductAffected versions
– lxc incus < 7.5.0
Debian:13 debian incus < 6.0.4-2+deb13u11
Fix: upgrade to 6.0.4-2+deb13u11
Debian:14 debian incus < 7.0.1-5
Fix: upgrade to 7.0.1-5
Original advisory text
Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options
Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move operations. Attackers can set the option on a custom volume and trigger a copy or move onto a formatting pool to inject arguments into mkfs executed as root.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.0 Critical
Type
CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Timeline
Published22 Oct 2026
Updated23 Oct 2026
First seen22 Oct 2026
Sources
CVE-2026-115372 · NVD
CVE-2026-115372 · MITRE
DEBIAN-CVE-2026-115372 · OSV
CVE-2026-115372 · OSV
GHSA-4cph-ccqv-hm3c · GHSA
Track software like this
Free during beta