CVE-2026-62941

Description

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check (`AllowInstanceCreation`) runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys (including `security.privileged`, `raw.lxc`, `raw.apparmor`) from the source instance are merged AFTER the check passes, bypassing all project restrictions on the target project. Version 7.3.0 patches the issue.

CVSS Metrics

• v3.1•CRITICAL•Score: 9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Techniques & Countermeasures

• CWE-863•Incorrect Authorization

  The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Affected Systems

• debian•incus

  < 6.0.4-2+deb13u9 | < 7.0.1-2

• ubuntu•incus

  all

• lxc•incus

  < 7.3.0

References (5)

• https://ubuntu.com/security/CVE-2026-62941
• https://www.cve.org/CVERecord?id=CVE-2026-62941
• https://github.com/lxc/incus/security/advisories/GHSA-mq9x-prm8-3vpw
• https://github.com/lxc/incus/pull/3750
• https://security-tracker.debian.org/tracker/CVE-2026-62941