External risk intelligence

Incus Project Restriction Bypass Via Block Create Options

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-115372

Incus is a system container and virtual machine manager typically used for infrastructure management. While it offers network-accessible APIs, these are generally intended for internal administration or orchestration within secure management networks. It is not designed to be a public-facing internet service, and deployment of the management interface directly to the open internet is uncommon and restricted.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a vulnerability in Incus, a system for managing containers and virtual machines. The issue allows users with limited project access to bypass restrictions, potentially leading to the injection of arguments into system commands executed with root privileges. The primary concern is to confirm if this technology is in use and if it is exposed in a way that could be exploited.

Bypass allows unauthorized command argument injection.
Confirms if technology is in use and exposed.
Assess relevance to current infrastructure.

Attack Path

How an attacker could exploit the issue

An attacker with limited project access could exploit this vulnerability by manipulating volume operations. By creating or updating a volume with specific options, they can then copy or move this volume to a different pool. This action causes a command injection, allowing arbitrary arguments to be passed to a system command that runs with root privileges.

Restricted user access required.
Volume operations trigger command injection.
Root-level code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a restricted user to inject commands into system utilities that run with root privileges. When supported by the advisory, this could occur during volume operations when a custom volume is copied or moved to a formatting pool.

Root access to the host system.
Restricted user initiates volume operations.
Host system command execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Systems running Incus are likely managed by infrastructure or platform teams, with security teams responsible for network exposure and vendor-management teams for coordination with the Incus project. The immediate priority is to identify all Incus instances, confirm their reachability and business criticality, and then assign an accountable owner for remediation planning.

Infrastructure or Platform teams own this issue.
Verify Incus instance reachability and criticality.
Plan remediation based on confirmed exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Incus and how is it used?

Incus is a robust system container and virtual machine manager. Organizations use it to simplify the creation, management, and orchestration of isolated environments across physical or virtual servers. It provides a unified interface for handling storage pools, networking, and compute resources, serving as a critical piece of infrastructure for teams running multi-tenant or scalable application architectures.

What is the vulnerability in CVE-2026-115372?

This flaw is an Argument Injection (CWE-88). It occurs because the software fails to properly sanitize user-provided configuration options when handling storage volumes. A restricted user can inject malicious commands into the system's storage formatting utility. Because this utility runs with root privileges, the injected commands execute with those same high-level permissions, effectively escalating the user's control over the host.

How does an attacker trigger this CVE-2026-115372 flaw?

An attacker must have at least limited project access to the Incus instance. They trigger the bug by setting specific creation options on a custom volume and then performing a copy or move operation to a new storage pool. Simply having access to a volume is not enough; the vulnerability only manifests when the system performs these specific volume management operations that involve invoking external formatting commands.

Is my Incus deployment at risk?

If you manage Incus, you should evaluate your environment's exposure. According to Halo Surface Signal, Incus is typically intended for internal administration or secure management networks rather than direct exposure to the public internet. If your management API is only accessible to authorized internal users, the likelihood of an external, unauthenticated attacker reaching the system is significantly reduced.

How should I respond to CVE-2026-115372?

First, identify all instances of Incus within your environment and determine who owns each one. Prioritize checking if any instances are reachable from untrusted network segments. Once your inventory is clear, coordinate with your platform team to prepare for updates, as the primary path to resolution involves applying the official patches provided by the Incus project to address the project restriction bypass.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.