CVE-2026-115372 Details

A project restriction bypass vulnerability has been identified in Incus versions 7.3.0 prior to 7.5.0. This vulnerability allows users in restricted projects to manipulate 'block.create_options' through volume update, copy, and move operations. By setting specific options on a custom volume and triggering a copy or move to a formatting pool, attackers can inject arguments into the 'mkfs' command executed as root. This issue arises because the restriction only applies to direct volume creation, leaving other paths vulnerable.

Users are advised not to grant custom volume creation permissions to restricted projects on pools that format volumes during the copy process. Alternatively, 'volume.block.create_options' can be set at the pool level to apply a default that overrides individual volume settings.