CVE-2026-62867

Executive Summary

CVE-2026-62867 is a high-severity argument injection vulnerability (CVSS 9.9) in Incus, a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-controlled block.create_options in storage volume configuration allows a project-scoped (low-privileged) user to inject arbitrary arguments into a filesystem-creation command that executes as root. Successful exploitation results in arbitrary command execution with root privileges, leading to full host compromise. The vulnerability is remotely exploitable over the network without user interaction, affects all Incus deployments prior to 7.3.0, and has no known public PoC or in-the-wild exploitation as of this report.

Technical Analysis

Incus manages system containers and virtual machines, exposing a REST API to authenticated users. Access control is enforced via projects, which allow tenants to operate within isolated scopes. The vulnerability resides in the storage volume configuration handling, specifically the block.create_options parameter.

Vulnerability Mechanism: When a user creates a storage volume with block device backing, Incus constructs a command line to build the filesystem on the raw block device. The affected code path concatenates user-supplied block.create_options into this command string without proper sanitization or quoting. Because the option value is placed directly into the command line executed by a privileged process (running as root), a malicious user can terminate the intended argument list with a delimiter (e.g., --) and inject additional flags or commands.

Attack Surface: The vulnerable surface is the Incus REST API endpoint that accepts storage volume creation requests with block.create_options. A project-scoped user—one with permissions only within an assigned project, not root admin—can submit crafted values. The API is network-accessible (AV:N), and the attack requires only low privileges (PR:L) and no user interaction (UI:N).

Technical Detail (class-level): This is a classic CWE-88 (Improper Neutralization of Argument Delimiters) flaw. The discrete nature of the command construction means that arguments such as trailing -- followed by --exec or similar delimiters (depending on the underlying mkfs utility) can cause the binary to interpret subsequent strings as options or commands. Because the binary runs as root, the injected arguments inherit root privileges.

No source code details are available beyond the NVD description; no specific function names, filesystem utilities (e.g., mkfs.ext4), or exact injection syntax (e.g., --use-direct-io=0) are disclosed. The attack mechanism is therefore described at the vulnerability-class level, which is sufficient for detection and mitigation planning. Insufficient technical detail is available to specify exact payload grammar or the precise binary invoked.

Exploitation Scenarios

The attack chain is inferred from the vulnerability class and the NVD description. No public PoC or exploit code is currently available.

Step 1 — Reconnaissance / Target Identification: An attacker with valid credentials to any project within an Incus deployment performs API enumeration to identify the storage volume creation endpoint. Tools like incus CLI (as an authenticated client) or direct REST API queries against /1.0/storage-pools/{pool}/volumes (paths inferred from standard Incus API structure, not specified in the advisory) can be used. The attacker verifies the Incus version is below 7.3.0 via version disclosure or by attempting the exploit.

Step 2 — Flaw Trigger: The attacker submits a storage volume creation request that includes a crafted block.create_options value. The value is designed to break out of the intended option list. For example, if the constructed command is mkfs.ext4 <options> /dev/block-device, the attacker appends -- followed by additional flags that the mkfs utility interprets as commands or further options (e.g., --exec /bin/sh or a setuid-helper invocation, depending on the binary). The exact delimiters depend on the underlying filesystem utility, but the injection vector is the unvalidated string.

Step 3 — Execution Method: The injected arguments cause the root-executed filesystem-creation binary to perform unintended actions. In a best case for the attacker, the binary supports a mode that enables command execution (e.g., a --exec flag in certain utilities). In a worst case for the attacker, the injected arguments cause the binary to write files to arbitrary paths or set file permissions to create a backdoor. Since the process runs as root, any file-write or execution capability translates directly to root-level compromise.

Step 4 — Post-Exploitation: With root access on the Incus host, the attacker can: (a) read all container/VMs data, (b) exfiltrate secrets and SSH keys, (c) pivot to other systems on the network, (d) install persistent backdoors, and (e) leverage the hypervisor position to compromise other tenants' workloads — a full infrastructure-level breach. Because the provided CVSS vector includes Scope:Changed (S:C), the impact extends beyond the vulnerable component to the broader host environment.

Realistic Path: No public PoC exists; this chain represents the expected exploitation flow based on the vulnerability class. Attackers with access to an Incus API endpoint (which may be exposed to the internet or internally only) can chain this with initial access via stolen credentials, a compromised management console, or phishing of admin users.

Impact Assessment

Business Impact: Full compromise of the Incus host operating system and all hosted workloads (containers, VMs). This is a "game over" scenario for multi-tenant environments where the host is shared infrastructure. Data confidentiality, integrity, and availability are all compromised (C:H/I:H/A:H in CVSS). The Scope:Changed (S:C) means the impact extends beyond the Incus process to the host kernel and other services.

Affected Systems: All Incus installations running versions prior to 7.3.0. This includes deployments using Incus as a stand-alone container manager or as the underlying engine for orchestration platforms.

Blast Radius: Critical — a single low-privileged project user can escalate to root. In multi-tenant clouds, this enables cross-tenant attacks. The attack does not require social engineering or phishing.

Additional Metrics: CVSS 9.9 (Critical). The PR:L factor indicates that the attacker must already have a valid account, which may slow external attackers but is trivially satisfied by internal users (employees, customers) with project access. No authentication bypass is implied; this is a privilege escalation from low to root.

Detection Guidance

Detection focuses on: (1) anomalous API calls containing suspicious block.create_options values, (2) unusual filesystem-creation command invocations, and (3) post-exploitation behavior (spawning shells from storage daemons).

Sigma Rule

title: Incus block.create_options Argument Injection Attempt
id: 3f4c8e2b-7f22-4a6d-9b0d-1e5f4a2c8e7d
status: experimental
description: Detects API requests to Incus containing suspicious block.create_options values indicative of argument injection (CVE-2026-62867).
logsource:
    product: incus
    service: api
detection:
    selection:
        endpoint: "/1.0/storage-pools/*/volumes"   # Inferred API path; adjust as needed
        method: "POST"
        request_body|contains:
            - "block.create_options"
        request_body|re:
            - "--.*\\s+--"                          # Double-dash break
            - "--(exec|sh|cmd|printf|wget|curl)\\s"
    condition: selection
level: critical
falsepositives:
    - Legitimate unusual mkfs options (e.g., custom stripe sizes). Tune based on standard admin behavior.
fields:
    - src_ip
    - user_agent
    - request_body
tags:
    - cve-2026-62867
    - attack.t1203
    - cwe.88

YARA Rule

rule incus_block_create_options_injection {
    meta:
        author = "valtersit.com"
        description = "Detects crafted block.create_options payloads targeting Incus CVE-2026-62867"
        date = "2026-01-01"
        reference = "CVE-2026-62867"
        severity = "critical"
    strings:
        $opt = "block.create_options"
        $break1 = " -- " 
        $break2 = "--exec"
        $break3 = "--sh"
        $break4 = "--cmd"
        $break5 = "--interactive"
        $path = "storage"  // broader context
    condition:
        $opt and (any of ($break*) or #break1 > 1)
}

Suricata IDS Rule

alert http any any -> $EXTERNAL_NET any (
    msg:"CVE-2026-62867 Incus block.create_options Argument Injection Attempt";
    flow:established,to_server;
    http.method;
    content:"POST";
    http.uri;
    content:"storage-pools";
    content:"volumes";
    http.request_body;
    content:"block.create_options";
    pcre:"/--(exec|sh|cmd|printf|wget|curl)\b/im";
    classtype:attempted-admin;
    sid:2026062867;
    rev:1;
    reference:cve,2026-62867;
    metadata:created_at 2026_01_01, updated_at 2026_01_01;
)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where event.action == "connection_attempted" and destination.port == 8443 ] // Incus API default port
  [ http where request.method == "POST" and 
    request.uri : "*storage-pools*volumes*" and 
    request.body : "*block.create_options*" and 
    request.body : "*--exec*" ] // Adjust for other flags

Splunk SPL Query

index=incus_api sourcetype=incus:api:req
| where method=="POST" AND uri LIKE "%storage-pools%volumes%"
| search request_body="*block.create_options*"
| regex request_body="--(exec|sh|cmd|printf|wget|curl)[\s|=]"
| table _time, src_ip, user, uri, request_body
| sort - _time

Wazuh OSSEC Rule

<group name="incus,">
  <rule id="100267" level="15">
    <decoded_as>json</decoded_as>
    <field name="event.type">POST</field>
    <field name="uri">\.*storage-pools.*volumes</field>
    <field name="request_body">\.*block\.create_options.*</field>
    <regex>--(exec|sh|cmd|printf|wget|curl)</regex>
    <description>Incus CVE-2026-62867: Arbitrary argument injection in storage volume creation</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>incus,attack.privilege_escalation,cwe.88,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY) — the fix is confirmed by Debian package sources, and Incus version 7.3.0 is the patched release.

1. Immediate Mitigations (if patch cannot be applied immediately):

   • Restrict access to the Incus API to trusted networks only (reduce AV:N exposure).
   • Disable project-level user creation of storage volumes if not strictly required.
   • Apply network ACLs to block internet-facing access to Incus API endpoints.
   • Monitor storage volume creation API calls for anomalous block.create_options values.

2. Patch/Upgrade Steps:

   • Upgrade Incus to version 7.3.0 or later immediately.
   • For Debian-based systems: apt update && apt upgrade incus (or use the official Incus repository for the latest version).
   • Verify the patched version: incus version should show 7.3.0+.
   • After patching, restart the Incus daemon to ensure the new binary is active.

3. Long-Term Hardening:

   • Apply the principle of least privilege: validate that project users genuinely need storage volume creation rights.
   • Implement input validation at the application layer as defense-in-depth — do not rely solely on upstream patches for user-supplied options.
   • Audit frequently for unintended exposure of management APIs (e.g., Shodan dorks listed above).
   • Establish a patching cadence for infrastructure management software; this vulnerability is network-exploitable and critical.

Additional Advisory: No workarounds are provided by the vendor. Since the flaw allows root compromise and has a near-maximum CVSS score, prioritize patching above other routine maintenance.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-62867
2. Incus Official Releases / Security Announcements — https://github.com/lxc/incus/releases (version 7.3.0)
3. Debian Security Tracker — https://security-tracker.debian.org/tracker/CVE-2026-62867
4. MITRE CWE-88 — https://cwe.mitre.org/data/definitions/88.html (Improper Neutralization of Argument Delimiters)
5. CISA KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (not listed; no evidence of in-the-wild exploitation)

As of this report, no threat actor campaigns or confirmed exploits in the wild are documented for CVE-2026-62867. However, given the CVSS 9.9 score and the low complexity of exploitation once API access is obtained, rapid weaponization by threat actors is a credible short-term risk. Organizations should assume that proof-of-concept code may emerge and apply the patch immediately regardless of current exploit status.