CVE-2026-62867 lxc CVE debrief

Who should care

Defenders managing Incus deployments, particularly those with project-scoped user access, should assess exposure and verify if their configurations are vulnerable to argument injection attacks.

Why it matters

CVE-2026-62867 allows project-scoped users in Incus to inject arbitrary arguments into filesystem creation commands executed as root, potentially leading to privilege escalation and unauthorized access. Defenders should verify exposure, assess potential impact, and prioritize remediation.

• Potential for arbitrary argument injection into filesystem creation commands executed as root.
• Possible elevation of privileges for project-scoped users.
• Risk of unauthorized access to sensitive data or systems.
• Need for verification of Incus version and configuration to ensure remediation.

Technical summary

The Incus system container and virtual machine manager is vulnerable to argument injection due to improper validation of user-provided block.create_options in storage volume configuration. This allows project-scoped users to inject arbitrary arguments into filesystem creation commands executed as root, potentially leading to privilege escalation and unauthorized access. The vulnerability affects Incus versions prior to 7.3.0. Defenders should verify exposure, assess potential impact, and prioritize remediation, focusing on project-scoped user access and storage volume configurations.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on project-scoped user access and storage volume configurations.

Recommended defensive actions

• Verify Incus version and assess exposure by checking current version against 7.3.0 or later.
• Review project-scoped user access and storage volume configurations for potential vulnerabilities.
• Implement compensating controls, such as restricting user access to storage volume configuration.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Incus, a system container and virtual machine manager, related to improper validation of user-provided block.create_options in storage volume configuration, leading to argument injection.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.