CVE-2026-62867

Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided `block.create_options` in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject arbitrary arguments into the binary executed as root. Version 7.3.0 patches the issue.

Score

CVSS 3.1 9.9 Critical

Status

Deferred - security-advisories@github.com

Published

2026-08-21

Last modified

2026-10-15

Weaknesses

CWE-88

Affected products

• Incus (Lxc)

References

• https://github.com/lxc/incus/security/advisories/GHSA-q7xw-r4w2-2wcm