CVE-2026-62940: Incus has a project restriction bypass via instance migration config override
Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configuration overrides (including security-critical keys like security.privileged and raw.lxc) are applied without any project restriction enforcement, allowing a restricted project user to escalate to a privileged container and escape to the host. Version 7.3.0 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.3.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with access to a restricted Incus project who can migrate an instance to another cluster member can exploit it. The attack is network-accessible and requires low privileges, but no user interaction.
What conditions are required for exploitation?
The vulnerable path is instance migration between cluster members. The attacker must be able to provide migration configuration overrides, which are applied without enforcing project restrictions.
What is the impact of a successful exploit?
An attacker can set security-critical configuration such as security.privileged or raw.lxc, escalate a restricted project instance into a privileged container, and escape to the host. This can compromise confidentiality, integrity, and availability beyond the affected project.
Which versions are affected and what is the fix?
Incus versions prior to 7.3.0 are affected. Upgrade to Incus 7.3.0, which enforces project restrictions for user-supplied configuration overrides during migration.
What can be done before upgrading?
Restrict untrusted or restricted-project users from migrating instances between cluster members, particularly where they can supply configuration overrides. Review migration permissions and avoid allowing overrides of security-sensitive keys such as security.privileged and raw.lxc.