CVE-2026-62313: Incus: Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated`
Incus is a system container and virtual machine manager. Prior to version 7.3.0, project-level enforcement of restricted.containers.privilege=isolated can be trivially bypassed, allowing a user to create a non-isolated (shared host idmap) container in a project that is configured to forbid them. The restriction only rejects an explicitly set security.idmap.isolated=false (or empty) and fails to enforce anything when the key is omitted entirely. Because an unset security.idmap.isolated defaults to false (non-isolation), a user simply leaves the key out and obtains exactly the container state the restriction is meant to forbid. This defeats the tenant-isolation guarantee the restriction exists to provide. Containers in the project share the host uid/gid map instead of receiving unique, non-overlapping ranges, weakening the isolation boundary between co-tenant containers and the host. Version 7.3.0 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Incusto a version that resolves this vulnerability.Fixed in 7.3.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with sufficient privileges to create containers in a project configured with restricted.containers.privilege=isolated can exploit it. The issue affects multi-tenant environments that rely on this project restriction to require isolated UID/GID mappings.
What does an attacker need to do to bypass the restriction?
The attacker creates a container without setting security.idmap.isolated. Because the unset value defaults to false, the resulting container uses a shared host ID map even though the project is intended to require isolation.
Are projects using this restriction safely protected by default?
No. The restriction rejects an explicitly false or empty security.idmap.isolated value, but does not reject an omitted value. Omitting the key produces the non-isolated default state that the restriction is intended to prevent.
How can I tell whether a container was created through the bypass?
Check whether containers in affected restricted projects have security.idmap.isolated unset and are using a shared host UID/GID map rather than unique, non-overlapping ranges. An unset key defaults to non-isolation.
What version fixes the issue?
Incus version 7.3.0 patches the issue.