CVE-2026-115372: Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options

Q: Which environments are exposed to this issue?

Incus versions from 7.3.0 up to, but not including, 7.5.0 are affected. Exposure requires restricted project users and a workflow involving custom volumes and a formatting pool.

Q: What does an attacker need to exploit the issue?

The attacker needs restricted-project access and must be able to set block.create_options on a custom volume through a volume update, copy, or move operation. They must then trigger a copy or move onto a formatting pool, where the supplied arguments reach mkfs running as root.

Q: What is the remediation version?

Upgrade Incus to version 7.5.0 or later. Versions before 7.5.0, starting with 7.3.0, contain the restriction bypass.

Q: How can administrators assess whether their deployment is at risk?

Check whether the Incus version is in the affected range and whether restricted project users can perform volume updates, copies, or moves involving custom volumes. Risk is particularly relevant where those operations can target formatting pools.

Published Oct 22, 2026

Updated

Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.createoptions through volume update, copy, and move operations. Attackers can set the option on a custom volume and trigger a copy or move onto a formatting pool to inject arguments into mkfs executed as root.

Affected Software

1 affected component

Linux Containers Incus>=7.3.0<7.5.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Incus to a version that resolves this vulnerability.
Fixed in 7.5.0

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which environments are exposed to this issue?

Incus versions from 7.3.0 up to, but not including, 7.5.0 are affected. Exposure requires restricted project users and a workflow involving custom volumes and a formatting pool.

What does an attacker need to exploit the issue?

The attacker needs restricted-project access and must be able to set block.create_options on a custom volume through a volume update, copy, or move operation. They must then trigger a copy or move onto a formatting pool, where the supplied arguments reach mkfs running as root.

What is the remediation version?

Upgrade Incus to version 7.5.0 or later. Versions before 7.5.0, starting with 7.3.0, contain the restriction bypass.

How can administrators assess whether their deployment is at risk?

Check whether the Incus version is in the affected range and whether restricted project users can perform volume updates, copies, or moves involving custom volumes. Risk is particularly relevant where those operations can target formatting pools.

CVE-2026-115372: Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options

Affected Software

Remediation

Event History

Frequently Asked Questions

Which environments are exposed to this issue?

What does an attacker need to exploit the issue?

What is the remediation version?

How can administrators assess whether their deployment is at risk?

Company

Resources

Contact

Frequently Asked Questions

Which environments are exposed to this issue?

What does an attacker need to exploit the issue?

What is the remediation version?

How can administrators assess whether their deployment is at risk?