Every CVE Search/ Get API key

CVE-2026-62867

Incus has an argument injection in storage volume block.create_options that leads to arbitrary command execution

9.9 CriticalFix available

Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided block.create_options in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject arbitrary arguments into the binary executed as root. Version 7.3.0 patches the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.52%Unchanged since Aug 22, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.9

Incus has an argument injection in storage volume block.create_options that leads to arbitrary command execution

Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided block.create_options in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject arbitrary arguments into the binary executed as root. Version 7.3.0 patches the issue.

Record
CVE-2026-62867
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-88
Updated
2026-11-02
EUVDEUVD-2026-63987 9.9

Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided block.create_options in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject arbitrary arguments into the binary executed as root. Version 7.3.0 patches the issue.

Record
EUVD-2026-63987
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
NVD 9.9

Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided block.create_options in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject arbitrary arguments into the binary executed as root. Version 7.3.0 patches the issue.

Record
CVE-2026-62867
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-88
Updated
2026-11-02
OSV 9.9

Incus has an argument injection in storage volume block.create_options that leads to arbitrary command execution

Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided block.create_options in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject arbitrary arguments into the binary executed as root. Version 7.3.0 patches the issue.

Record
CVE-2026-62867
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-88
Updated
2026-11-02
OSVDEBIAN-CVE-2026-62867 9.9

Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided block.create_options in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject arbitrary arguments into the binary executed as root. Version 7.3.0 patches the issue.

Record
DEBIAN-CVE-2026-62867
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-62867 9.9

Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided block.create_options in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject arbitrary arguments into the binary executed as root. Version 7.3.0 patches the issue.

Record
UBUNTU-CVE-2026-62867
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-04
OSVopenSUSE-SU-2026:11651-1 No score

incus-7.4-1.1 on GA media

These are all security issues fixed in the incus-7.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11651-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
incus
Debian:13
 before 6.0.4-2+deb13u9, plus listed versions
6.0.4-26.0.4-2+deb13u16.0.4-2+deb13u1~bpo12+16.0.4-2+deb13u26.0.4-2+deb13u2~bpo12+1
Show 11 moreShow less
6.0.4-2+deb13u36.0.4-2+deb13u3~bpo12+16.0.4-2+deb13u46.0.4-2+deb13u4~bpo12+16.0.4-2+deb13u56.0.4-2+deb13u5~bpo12+16.0.4-2+deb13u66.0.4-2+deb13u6~bpo12+16.0.4-2+deb13u76.0.4-2+deb13u7~bpo12+16.0.4-2+deb13u8
6.0.4-2+deb13u9
incus
Debian:14
 before 7.0.1-2, plus listed versions
6.0.4-26.0.4-36.0.5-16.0.5-26.0.5-3
Show 27 moreShow less
6.0.5-46.0.5-56.0.5-66.0.5-76.0.5-86.0.6-16.0.6-26.0.6-36.14.0-1~exp16.15.0-1~exp16.16.0-1~exp16.17.0-1~exp16.20.0-1~exp16.21.0-1~exp16.22.0-1~exp16.23.0-1~exp17.0.0-17.0.0-1~bpo13+17.0.0-27.0.0-2~bpo13+17.0.0-37.0.0-47.0.0-57.0.0-5~bpo13+17.0.1-17.0.1-1~bpo13+17.0.1-2~bpo13+1
7.0.1-2
incus
Ubuntu:26.10
 All versions, plus listed versions
6.0.5-87.0.1-5
 None known
incus
openSUSE:Tumbleweed
 before 7.4-1.1
7.4-1.1

History

History
RecordedChangedSources
affected, factsOSV
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-62867 is a critical vulnerability (CVSS 9.9) in Lxc Incus, published August 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in incus 6.0.4-2+deb13u9.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open