What’s Vulnerable › Vulnerabilities
CVE-2026-62867: Incus has an argument injection in storage volume block.create_options that leads to arbitrary command execution
- Severity: critical (CVSS 9.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-21 · updated 2026-10-15
- Weakness: CWE-88
Description
Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided `block.create_options` in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject arbitrary arguments into the binary executed as root. Version 7.3.0 patches the issue.
Affected products
- lxc incus: before 7.3.0
References
Get alerted when CVE-2026-62867 or the next vulnerability affects your stack