Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115372— Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options

Quick assessment

Affected
lxc incus
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Incus 7.3.0 至 7.5.0 版本（不含 7.5.0）存在项目限制绕过漏洞。该漏洞允许受限项目用户通过卷的更新、复制和移动操作设置 选项。攻击者可在自定义卷上设置该选项，并触发向格式化存储池（formatting pool）的复制或移动操作，从而将恶意参数注入以 root 权限执行的 命令。

CVSS 8.5 · High

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 2

VendorProduct Version RangeStatus
lxc incus 7.3.0< 7.5.0 affected
7.5.0 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-115372

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options
Source: CVE Program / CVE List V5
Vulnerability Description
Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move operations. Attackers can set the option on a custom volume and trigger a copy or move onto a formatting pool to inject arguments into mkfs executed as root.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
参数注入或修改
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
lxc incus 7.3.0 ~ 7.5.0 -

II. Public POCs for CVE-2026-115372

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115372

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-115372 (2)

Same Patch Batch · lxc · 2026-10-22 · 9 CVEs total

CVE-2026-115377 9.9 CRITICAL Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Sy
CVE-2026-115375 9.9 CRITICAL Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Depende
CVE-2026-115376 7.7 HIGH Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 Project Restriction Bypass via Custom Volu
CVE-2026-115374 7.1 HIGH Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Unsigned Header Bypass in Presigned S3 Upl
CVE-2026-115371 7.1 HIGH LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential
CVE-2026-115373 6.3 MEDIUM Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GE
CVE-2026-115378 5.8 MEDIUM Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Re
CVE-2026-115370 4.3 MEDIUM Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project B

IV. Related Vulnerabilities

Same product: incus
Same vendor: lxc
Same weakness: CWE-88

V. Comments for CVE-2026-115372

No comments yet

Leave a comment