8.5Yüksek
CVE-2026-115372Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options
Açıklama
Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move operations. Attackers can set the option on a custom volume and trigger a copy or move onto a formatting pool to inject arguments into mkfs executed as root.
Zayıflık türü (CWE):
CWE-88
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| linuxcontainers | incus | 7.3.0 – < 7.5.0 | |
| lxc | incus | 7.3.0 – < 7.5.0, fixed 7.5.0 |
Kaynaklar ve yamalar
- GitHub Security Advisory (GHSA-4cph-ccqv-hm3c) vendor-advisory
- VulnCheck Advisory: Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options third-party-advisory