CVE-2026-62941: Incus: Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge
Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check (AllowInstanceCreation) runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys (including security.privileged, raw.lxc, raw.apparmor) from the source instance are merged AFTER the check passes, bypassing all project restrictions on the target project. Version 7.3.0 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Incusto a version that resolves this vulnerability.Fixed in 7.3.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs privileges to copy an instance across Incus projects. The vulnerable path is a cross-project instance copy into a target project with restrictions that would normally block dangerous configuration.
Which configurations can bypass target project restrictions?
Dangerous source-instance configuration keys merged after the restriction check can bypass the target project's controls, including security.privileged, raw.lxc, and raw.apparmor.
Are installations running Incus 7.3.0 affected?
No. Version 7.3.0 patches the issue; versions prior to 7.3.0 are affected.
What should be prioritized if an immediate upgrade is not possible?
Restrict or disable cross-project instance copy operations for users who should not be able to introduce privileged or raw instance configuration into target projects.