CVE-2026-115372 lxc CVE debrief

Who should care

System administrators and security teams responsible for Incus deployments should assess exposure and prioritize remediation. Affected users should review and update Incus versions to 7.5.0 or later, restrict access to volume operations, and monitor for suspicious activity related to block.create_options. Security teams should also review compensating controls for exposed systems and track exceptions and retest remediated assets.

Why it matters

CVE-2026-115372 is a critical vulnerability in Incus that allows restricted project users to bypass project restrictions and potentially escalate privileges. System administrators and security teams should assess exposure and prioritize remediation.

• Potential privilege escalation through block.create_options injection
• Restrictive access controls may be bypassed by exploiting this vulnerability
• Successful exploitation requires authenticated access to the system

Technical summary

Incus from 7.3.0 before 7.5.0 contains a project restriction bypass vulnerability. Restricted project users can set block.create_options through volume update, copy, and move operations. An attacker can set the option on a custom volume and trigger a copy or move onto a formatting pool to inject arguments into mkfs executed as root. The vulnerability requires authenticated access to the system and can lead to potential privilege escalation. System administrators and security teams should assess exposure and prioritize remediation.

Defensive priority

High

Recommended defensive actions

• Review and update Incus versions to 7.5.0 or later
• Restrict access to volume update, copy, and move operations
• Monitor for suspicious activity related to block.create_options
• Perform vulnerability scanning and asset inventory to identify exposed systems
• Implement compensating controls for exposed systems while remediation is scheduled
• Track exceptions and retest remediated assets
• Review relevant monitoring, detection, and logs for exposed assets

Evidence notes

Official CVE Program record and NVD vulnerability detail provide information on the project restriction bypass in Incus. Vendor advisories and third-party reports offer additional context. The vulnerability has been confirmed in Incus versions 7.3.0 before 7.5.0. Limited source detail is available, and defenders should verify affected scope and severity. No exploit details are publicly available, but the vulnerability is considered critical.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.