Skip to content
fr Sign in
9.0 Critical

CVE-2026-115372 Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set…

Description

Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move operations. Attackers can set the option on a custom volume and trigger a copy or move onto a formatting pool to inject arguments into mkfs executed as root.

Affected products and versions

Product Affected versions Fixed in
incus 7.5 earliest → < 7.5.0 7.5.0
incus 7.3 7.3.0 → < 7.5.0 7.5.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of incus

The 47 CVEs of incus →
CVE-2026-115378 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in… 6.9 Medium CVE-2026-115377 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that… 9.4 Critical CVE-2026-115376 Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows… 8.3 High CVE-2026-115375 Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes 9.4 Critical
Track this CVE