Incus: Project restriction bypass and privilege escalation (CVE-2026-115372)
A project restriction bypass in Incus 7.3.0 through 7.4.x allows restricted users to inject malicious arguments into the mkfs command, leading to privilege escalation on the host.
CVE search metadata
CVE search record: CVE-2026-115372. Severity: high. CVSS: 8.5. KEV: no. Product: Incus (7.3.0 - 7.4.x), Incus (7.0.0-7.0.1, 7.1.0-7.4.x). Brief: Incus: Project restriction bypass and privilege escalation (CVE-2026-115372). Brief link: https://feed.craftedsignal.io/briefs/2026-10-incus-restriction-bypass/
CVE search record: CVE-2026-115374. KEV: no. Product: Incus (7.3.0 - 7.4.x), Incus (7.0.0-7.0.1, 7.1.0-7.4.x). Brief: Incus: Project restriction bypass and privilege escalation (CVE-2026-115372). Brief link: https://feed.craftedsignal.io/briefs/2026-10-incus-restriction-bypass/
Triage facts
Revision 1- Applicability
- Incus (7.3.0 - 7.4.x), Incus (7.0.0-7.0.1, 7.1.0-7.4.x)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 22, 20:28 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- A1Likely
What's new
- 1. added coverage for Incus (7.0.0-7.0.1, 7.1.0-7.4.x) Oct 22, 20:28 via nvd
Incus versions 7.3.0 through 7.4.x (prior to 7.5.0) contain a project restriction bypass. The vulnerability allows users within a restricted project to set the 'block.create_options' property during volume update, copy, or move operations. An attacker can leverage this to inject arbitrary arguments into the 'mkfs' command, which is executed with root privileges by the Incus daemon on the host.
Impact
Successful exploitation allows a restricted project user to achieve command execution with root privileges on the underlying host system.
Recommendation
Upgrade Incus to version 7.5.0 or later immediately to remediate the vulnerability. If an upgrade is not immediately feasible, restrict the ability of untrusted users to perform volume update, copy, or move operations within projects where project restrictions are relied upon for security isolation.
Immediate actions
Upgrade Incus instances to version 7.5.0 or later
Mitigations
Upgrade Incus to 7.5.0
CVE-2026-115372