CVE-2026-62867: Incus has an argument injection in storage volume block.create_options that leads to arbitrary command execution
Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided block.createoptions in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject arbitrary arguments into the binary executed as root. Version 7.3.0 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Incusto a version that resolves this vulnerability.Fixed in 7.3.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A project-scoped Incus user can exploit it by supplying crafted block.create_options in storage volume configuration. Exploitation does not require user interaction.
What level of access can successful exploitation provide?
The injected arguments reach a filesystem-creation binary executed as root, allowing arbitrary command execution with root privileges.
Which Incus versions are affected?
Incus versions prior to 7.3.0 are affected. Version 7.3.0 patches the issue.