A critical argument injection vulnerability in lxc Incus allows authenticated project users to achieve root execution on the underlying host.

The vulnerability stems from improper validation of user-provided configuration options within storage volumes. This allows an authenticated user with project-level access to inject malicious arguments into commands executed by the system with root privileges.

Successful exploitation allows an attacker to break out of their restricted project environment and gain full administrative control over the host system. Given the CVSS score of 9.9, this vulnerability represents an extreme risk to infrastructure integrity, as it facilitates complete system compromise and potential lateral movement within the network.

Immediate Action: Upgrade lxc Incus to version 7.3.0 or later immediately to apply the necessary input validation patches.

Proactive Monitoring: Audit system logs for unexpected binary executions or unusual command-line arguments initiated by the Incus service user.

Compensating Controls: Restrict project access to only highly trusted users until the software can be patched, and ensure that the host OS is hardened against container breakout techniques.

Public Exploit Available: No

This vulnerability presents a severe risk to host security and multi-tenant isolation. Administrators must prioritize updating to version 7.3.0 to neutralize this command injection vector and prevent unauthorized root access.