Project Restriction Bypass in Incus by Canonical

CVE-2026-115372

What is CVE-2026-115372?

Incus versions prior to 7.5.0 are susceptible to a project restriction bypass vulnerability. This allows unauthorized users to manipulate block.create_options during volume operations such as update, copy, and move. By exploiting this weakness, attackers can set configurations on a custom volume, triggering actions that inject arguments into the mkfs command executed with root privileges. This oversight poses significant risks to system integrity and can lead to unauthorized access and privilege escalation.

References