Skip to content
CVE PROGRAM SOURCE RECORD9.9 Critical

CVE-2026-62867

Incus has an argument injection in storage volume block.create_options that leads to arbitrary command execution

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided `block.create_options` in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject arbitrary arguments into the binary executed as root. Version 7.3.0 patches the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

lxc incus

  • < 7.3.0affected

References