CVE-2026-62941

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check (`AllowInstanceCreation`) runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys (including `security.privileged`, `raw.lxc`, `raw.apparmor`) from the source instance are merged AFTER the check passes, bypassing all project restrictions on the target project. Version 7.3.0 patches the issue.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/lxc/incus/security/advisories/GHSA-mq9x-prm8-3vpw
https://github.com/lxc/incus/security/advisories/GHSA-mq9x-prm8-3vpw

Configurations

No configuration.

History

15 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Incus es un gestor de contenedores de sistema y máquinas virtuales. Antes de la versión 7.3.0, al copiar una instancia entre proyectos, la comprobación de restricción de proyecto ('AllowInstanceCreation') se ejecuta ANTES de que la configuración de la instancia de origen se fusione en la solicitud. Claves de configuración peligrosas (incluyendo 'security.privileged', 'raw.lxc', 'raw.apparmor') de la instancia de origen se fusionan DESPUÉS de que la comprobación se aprueba, eludiendo todas las restricciones de proyecto en el proyecto de destino. La versión 7.3.0 corrige el problema.

Information

Published : 2026-08-21 15:16

Updated : 2026-10-15 19:10

NVD link : CVE-2026-62941

Mitre link : CVE-2026-62941

CVE.ORG link : CVE-2026-62941

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-62941", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62941", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-21T16:42:20.466737Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "lxc", "product": "incus", "versions": [{"status": "affected", "version": "< 7.3.0"}]}]}], "published": "2026-08-21T15:16:46.287", "references": [{"url": "https://github.com/lxc/incus/security/advisories/GHSA-mq9x-prm8-3vpw", "source": "security-advisories@github.com"}, {"url": "https://github.com/lxc/incus/security/advisories/GHSA-mq9x-prm8-3vpw", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check (`AllowInstanceCreation`) runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys (including `security.privileged`, `raw.lxc`, `raw.apparmor`) from the source instance are merged AFTER the check passes, bypassing all project restrictions on the target project. Version 7.3.0 patches the issue."}, {"lang": "es", "value": "Incus es un gestor de contenedores de sistema y m\u00e1quinas virtuales. Antes de la versi\u00f3n 7.3.0, al copiar una instancia entre proyectos, la comprobaci\u00f3n de restricci\u00f3n de proyecto ('AllowInstanceCreation') se ejecuta ANTES de que la configuraci\u00f3n de la instancia de origen se fusione en la solicitud. Claves de configuraci\u00f3n peligrosas (incluyendo 'security.privileged', 'raw.lxc', 'raw.apparmor') de la instancia de origen se fusionan DESPU\u00c9S de que la comprobaci\u00f3n se aprueba, eludiendo todas las restricciones de proyecto en el proyecto de destino. La versi\u00f3n 7.3.0 corrige el problema."}], "lastModified": "2026-10-15T19:10:00.173", "sourceIdentifier": "security-advisories@github.com"}