CVE-2026-62867 in Incus
Summary
by MITRE • 08/21/2026
Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided `block.create_options` in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject arbitrary arguments into the binary executed as root. Version 7.3.0 patches the issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified in Incus prior to version 7.3.0 represents a critical security flaw rooted in improper input validation within the storage volume configuration mechanism. Specifically, the system fails to adequately sanitize or validate user-provided values for the block.create_options parameter when configuring storage volumes. This lack of rigorous sanitization allows an attacker who possesses project-scoped access privileges to manipulate the underlying command-line arguments passed during filesystem creation operations. The core technical flaw is a classic argument injection vulnerability where untrusted input is directly incorporated into system commands without sufficient filtering, enabling the execution of unintended binary instructions with elevated privileges.
From a technical perspective, this issue falls under CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. The attacker exploits the flexibility intended for legitimate configuration by injecting malicious arguments that are interpreted by the shell or command interpreter executing the filesystem creation binary. Because Incus operates with root-level privileges to manage system containers and virtual machines, any successful injection results in code execution within a high-privilege context. This bypasses standard user isolation boundaries, effectively granting the project-scoped attacker control over processes running as root on the host system.
The operational impact of this vulnerability is severe, potentially leading to full compromise of the underlying Incus server and all associated containers or virtual machines hosted upon it. An adversary can leverage this flaw to execute arbitrary commands, escalate privileges beyond their assigned scope, exfiltrate sensitive data from other tenants sharing the same infrastructure, or establish persistent backdoors within the host environment. This undermines the fundamental security model of multi-tenant container orchestration platforms where isolation between projects is paramount for maintaining trust and integrity across shared resources.
This vulnerability aligns with MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically regarding argument injection patterns that allow lateral movement or privilege escalation within a compromised environment. It also relates to CWE-284 Improper Access Control since the flaw allows actions beyond the authorized permissions of a project-scoped user. The ability to inject arguments into root-executed binaries effectively neutralizes access control mechanisms designed to restrict users to their designated projects, creating a significant risk for organizations relying on Incus for secure container management.
To mitigate this vulnerability, administrators must upgrade all affected Incus installations to version 7.3.0 or later where the issue has been patched through improved input validation and sanitization routines. Until upgrading is feasible, it is advisable to restrict project-scoped user permissions as much as possible, limiting access to storage volume configuration endpoints that accept block.create_options inputs. Additionally implementing strict network segmentation between management interfaces and untrusted networks can reduce the attack surface available for exploitation. Regular auditing of container configurations and monitoring for anomalous command executions in system logs should also be employed to detect potential attempts at exploiting this injection vector before full compromise occurs.