CVE-2026-62867: Incus Storage Volume RCE Vulnerability

CVE-2026-62867 Overview

CVE-2026-62867 affects Incus, a system container and virtual machine manager maintained by the LXC project. The vulnerability stems from improper validation of user-supplied block.create_options values in storage volume configuration. A project-scoped user can inject arbitrary arguments into the filesystem creation command line, which Incus executes as root. This results in argument injection [CWE-88] that crosses a privilege boundary from an unprivileged project user to the host root context. Incus version 7.3.0 patches the flaw. All versions prior to 7.3.0 are affected.

Critical Impact
A project-scoped Incus user can inject arguments into a root-executed filesystem creation command, enabling privilege escalation and full host compromise.

Affected Products

Incus system container and virtual machine manager, all versions prior to 7.3.0
Deployments exposing storage volume configuration to non-admin project users
Multi-tenant Incus environments with delegated project scopes

Discovery Timeline

2026-08-21 - CVE-2026-62867 published to the National Vulnerability Database (NVD)
2026-08-21 - Last updated in the NVD database
Version 7.3.0 - LXC project releases patched Incus build addressing the argument injection

Technical Details for CVE-2026-62867

Vulnerability Analysis

Incus constructs a filesystem creation command line, such as an invocation of mkfs, when a storage volume is created. The block.create_options volume configuration key is intended to pass safe formatting options to that command. Incus prior to 7.3.0 does not properly validate or restrict the option string. An attacker with rights to define or modify a storage volume within any project can supply option tokens that the shell or the underlying binary interprets as additional flags. Because Incus daemons run as root, the injected flags execute in the root context on the host, breaking the tenant isolation model that Incus projects are designed to enforce.

Root Cause

The root cause is improper neutralization of argument delimiters in a downstream component, classified as [CWE-88] Argument Injection. Incus accepts free-form option strings from project users and concatenates them into the filesystem creation command without an allowlist of options or a strict tokenization boundary. This design fails when tenant-supplied input reaches a privileged system utility.

Attack Vector

An authenticated user with project-level permissions to manage storage volumes sets block.create_options to a value containing attacker-controlled arguments. When Incus provisions the volume, the daemon executes the filesystem creation binary as root with the injected arguments appended. Depending on the target mkfs variant, injected flags can direct arbitrary file writes, load attacker-controlled configuration, or trigger execution paths that yield host code execution. The scope is changed (S:C in the CVSS vector) because the impact crosses from the project boundary into the host.

No verified exploit code is available in public sources at publication time. The GitHub Security Advisory (GHSA-q7xw-r4w2-2wcm) provides the authoritative technical description.

Detection Methods for CVE-2026-62867

Indicators of Compromise

Storage volume configuration entries where block.create_options contains shell metacharacters, leading dashes beyond expected mkfs options, or path arguments
Audit log entries showing volume create or update operations by non-admin project users immediately before unexpected root-owned file writes
mkfs process invocations by the Incus daemon with argument counts or flags that deviate from the baseline for the environment

Detection Strategies

Inspect Incus configuration state with incus storage volume show for every volume and flag any block.create_options value containing unexpected tokens
Enable process auditing on hosts running Incus and alert on mkfs.* executions spawned by incusd with non-standard flag sets
Correlate Incus API access logs with storage volume mutation events to attribute suspicious configuration changes to specific project users

Monitoring Recommendations

Ship Incus daemon logs and host auditd execve records to a central analytics platform for retrospective hunting
Baseline the normal argument shape of filesystem creation commands and alert on drift
Monitor for privilege boundary crossings such as root-owned file creation shortly after project-user API calls

How to Mitigate CVE-2026-62867

Immediate Actions Required

Upgrade Incus to version 7.3.0 or later on every host running the daemon
Audit existing storage volume configurations and remove or sanitize any suspicious block.create_options values before restarting workloads
Review project role assignments and revoke storage volume management rights for users who do not require them

Patch Information

The LXC maintainers fixed the issue in Incus 7.3.0. The fix enforces validation on the block.create_options configuration key so that project-supplied values cannot inject additional arguments into the filesystem creation command. See the Incus GitHub Security Advisory GHSA-q7xw-r4w2-2wcm for the authoritative patch reference.

Workarounds

Restrict the storage permission within Incus projects so only trusted administrators can create or modify storage volumes until the upgrade is applied
Remove block.create_options from any project-editable volume templates and set required filesystem options exclusively at the admin level
Isolate Incus hosts serving untrusted tenants on dedicated infrastructure to contain post-exploitation impact

bash

# Verify installed Incus version and upgrade
incus --version

# Debian/Ubuntu with the Zabbly repository
sudo apt update && sudo apt install --only-upgrade incus

# Confirm the daemon is running the fixed release
incus info | grep -i server_version

# Audit existing volumes for suspicious create options
for pool in $(incus storage list -f csv -c n); do
  for vol in $(incus storage volume list "$pool" -f csv -c n); do
    incus storage volume get "$pool" "$vol" block.create_options 2>/dev/null
  done
done