Organisations at Risk: Incus Volume Ops Let Restricted Users Run Root Commands in Versions Before 7.5.0
Restricted users in older Incus versions can bypass controls to run root commands via volume operations, posing a severe operational risk.
Key points
- Incus versions from 7.3.0 before 7.5.0 contain a critical project restriction bypass.
- The flaw allows restricted users to inject arguments into root-level formatting tools.
- Attackers exploit volume update, copy, and move operations to achieve privilege escalation.
Organisations relying on Incus infrastructure before version 7.5.0 face a critical security exposure that undermines container isolation. The vulnerability allows restricted project users to bypass intended limitations and execute commands with root privileges. This breach of trust affects the core operational integrity of any system using these specific software versions for resource management.
The risk
The flaw stems from a project restriction bypass within the Incus platform. According to the National Vulnerability Database, the issue is rated critical with a CVSS score of 9. The weakness is classified under CWE-88, indicating an improper handling of special elements. This classification highlights the severity of the input validation failure that permits unauthorized command execution.
Who is exposed
Any organisation running Incus version 7.3.0 or later but earlier than 7.5.0 is exposed to this threat. The vulnerability specifically impacts environments where restricted project users have access to volume management features. If these users can trigger volume update, copy, or move operations, they can exploit the flaw to escalate their privileges within the system.
Cost and compliance
The source material does not detail specific financial costs or compliance implications. However, the ability to execute root commands via mkfs injection suggests a complete compromise of the host system. Such breaches typically trigger significant incident response procedures and may violate security frameworks that require strict privilege separation and access controls within containerised environments.
What happens next
Managers should immediately audit their infrastructure to identify any instances of Incus running versions between 7.3.0 and 7.5.0. If these versions are in use, the organisation must plan an urgent upgrade to version 7.5.0 or later to mitigate the risk. Until the update is applied, restrict volume operations for all users to prevent potential exploitation of this bypass.
Questions to ask your suppliers
Teams should ask suppliers if they support the specific Incus versions currently in use and whether they have patched this issue. Determine who within the supplier organisation is responsible for monitoring and applying security updates to managed infrastructure. Check whether the supplier has a process for validating that all managed instances are running secure versions. Ensure that the supplier can provide evidence of updated configurations without delay.
Background: National Vulnerability Database
The National Vulnerability Database is a centralized repository that standardizes information about software weaknesses. It assigns unique identifiers to each flaw, allowing security tools to automatically detect and assess risks in your systems without manual research.
Read the full guide: National Vulnerability Database Explained: How NVD Works for You
What to do and how to stay safe: Incus
- Identify all systems running Incus versions from 7.3.0 up to but not including 7.5.0.
- Disable volume update, copy, and move operations for restricted project users to limit exposure.
- Upgrade to Incus version 7.5.0 or newer as soon as the vendor provides the update.
- Monitor system logs for unexpected mkfs executions or unusual volume activity that may indicate exploitation.
Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business
General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Incus versions are affected by CVE-2026-115372?
Versions from 7.3.0 before 7.5.0 are affected by this critical vulnerability.
How do attackers exploit this vulnerability?
Attackers set block.create_options on a custom volume and trigger copy or move operations to inject arguments into mkfs executed as root.
What is the CVSS score for this vulnerability?
The National Vulnerability Database rates the vulnerability as critical with a CVSS score of 9.
