CVE-2026-62940

Aliases:UBUNTU-CVE-2026-62940DEBIAN-CVE-2026-62940
PUBLISHED
Published: 21 Aug 2026, 14:47
Last modified:21 Aug 2026, 14:47

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.9 CRITICAL
v3.1 (cve.org)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

21 Aug 2026, 14:47
Published
Vulnerability first disclosed

Description

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configuration overrides (including security-critical keys like `security.privileged` and `raw.lxc`) are applied without any project restriction enforcement, allowing a restricted project user to escalate to a privileged container and escape to the host. Version 7.3.0 patches the issue.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Techniques & Countermeasures

  • CWE-862•Missing Authorization

    The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Affected Systems

  • debian•incus

    < 6.0.4-2+deb13u9 | < 7.0.1-2

  • ubuntu•incus

    all

  • lxc•incus

    < 7.3.0

References (5)