Description

Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided `block.create_options` in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject arbitrary arguments into the binary executed as root. Version 7.3.0 patches the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-21T15:16:46.003Z",
  "pubdate": "2026-08-21T15:16:46.003Z",
  "executiveSummary": "A vulnerability exists in Incus prior to version 7.3.0 involving improper validation of user-provided storage volume configuration parameters.\nSpecifically, the flaw occurs within the `block.create_options` parameter, leading to argument injection vulnerabilities in the underlying filesystem creation command line execution.\nThis security deficiency allows a project-scoped user to inject arbitrary command-line arguments into the binary that is executed with root privileges on the host system.\nThe primary impact of this vulnerability is privilege escalation and potential host compromise, as low-privileged users can manipulate administrative-level binary executions.\nAffected systems include Incus deployments running software versions prior to 7.3.0.\nExploitation requires project-scoped user access and the ability to configure storage volume options, enabling threat actors to leverage the container and virtual manager's administrative execution context to execute unauthorized commands or parameters at the highest privilege tier.",
  "technicalDetails": "The vulnerability resides in the storage volume configuration parsing logic of Incus prior to version 7.3.0, specifically within the handling of user-supplied `block.create_options` parameters.\nThe root cause is the improper sanitization and validation of input values before they are concatenated or passed directly into the constructed command line utilized for filesystem creation.\nBecause the filesystem creation command is executed with root privileges, any untrusted input embedded within `block.create_options` is interpreted directly by the binary as command-line arguments rather than discrete configuration data.\nAn attacker with project-scoped user privileges can craft a malicious storage volume configuration containing specially engineered strings designed to act as flags or parameters for the targeted filesystem creation utility.\nThe step-by-step attack flow begins with the authenticated project-scoped user defining a storage volume with malicious `block.create_options` payloads.\nUpon triggering the volume creation or initialization routine, Incus invokes the administrative binary to instantiate the filesystem.\nThe unsanitized `block.create_options` are appended to the execution string, resulting in argument injection.\nThe binary parses the injected arguments, altering its normal execution flow based on the attacker's input.\nSince the process executes with root privileges, this manipulation allows the attacker to achieve unauthorized administrative actions, subverting the intended security boundaries of the project scope.\nAuthentication is required at the project-scoped user level, and the vulnerable component is the storage volume configuration parser interfacing with backend filesystem generation binaries."
}