Cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3alinuxcontainersincus/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 20:28:33 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgIncus: Project restriction bypass and privilege escalation (CVE-2026-115372)https://feed.craftedsignal.io/briefs/2026-10-incus-restriction-bypass/Thu, 22 Oct 2026 20:28:33 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-incus-restriction-bypass/A project restriction bypass in Incus 7.3.0 through 7.4.x allows restricted users to inject malicious arguments into the mkfs command, leading to privilege escalation on the host.Incus versions 7.3.0 through 7.4.x (prior to 7.5.0) contain a project restriction bypass. The vulnerability allows users within a restricted project to set the 'block.create_options' property during volume update, copy, or move operations. An attacker can leverage this to inject arbitrary arguments into the 'mkfs' command, which is executed with root privileges by the Incus daemon on the host.

Impact

Successful exploitation allows a restricted project user to achieve command execution with root privileges on the underlying host system.

Recommendation

Upgrade Incus to version 7.5.0 or later immediately to remediate the vulnerability. If an upgrade is not immediately feasible, restrict the ability of untrusted users to perform volume update, copy, or move operations within projects where project restrictions are relied upon for security isolation.

]]>highadvisoryvulnerabilitys3incus