CVE-2026-115372GHSA-4cph-ccqv-hm3c
Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options
lxc incus
CVSS
9.0CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.36%Chance of exploitation activity in the next 30 days, higher than 28% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 7.5.0incusCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move operations. Attackers can set the option on a custom volume and trigger a copy or move onto a formatting pool to inject arguments into mkfs executed as root.
Text from CVE List
Affected versions 2
- incusaffected: 7.3.0 before 7.5.0CVE List
- incusunaffected: 7.5.0CVE List