CVE-2026-115372: Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options
Received
Published 22-10-2026Last modified 22-10-2026
Vulnerability summary
CVE-2026-115372 is a critical (CVSS 9.0) Argument Injection vulnerability in lxc incus.
CVSS score
9.0/10
010
Critical · v4.0 (CVE.org)EPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Timeline
- 22-10-2026PublishedVulnerability first disclosed.
Description
Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move operations. Attackers can set the option on a custom volume and trigger a copy or move onto a formatting pool to inject arguments into mkfs executed as root.
CVSS metrics
4 scores · 2 sources · 2 versionsCritical 9.0Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:HSourcesAll 2 agree
- NVDNIST9.0CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 8.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:HSourcesAll 2 agree
- NVDNIST8.5HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Lxc1 product
- incus≥ 7.3.0, < 7.5.0
1 vendor · 1 product
References
2 links- github.com/lxc/incus/security/advisories/GHSA-4cph-ccqv-hm3cVendor Advisory
- www.vulncheck.com/advisories/…Third Party Advisory