Executive brief
Incus is a container and virtual machine management platform used to run isolated workloads across multiple tenants. A flaw in its project-level isolation enforcement allows users to create non-isolated containers by simply omitting a security configuration key, defeating tenant isolation and exposing containers to cross-tenant attacks. An administrator who believes they have enabled mandatory isolation may unknowingly be running untrusted workloads in a shared host context.
Technical details
The vulnerability is a logic error in Incus's permission checking system for the `restricted.containers.privilege=isolated` project restriction. The permission checker iterates only over configuration keys explicitly present in the merged instance/profile config and skips validation when `security.idmap.isolated` is absent. Since the container runtime defaults absent `security.idmap.isolated` to `false` (non-isolated mode), an attacker can bypass the restriction by omitting the key entirely, reaching the forbidden non-isolated state without explicit rejection. This affects all entry points (instance create, instance update, profile update) because the underlying config validation logic is incomplete. The vulnerability allows an attacker with project membership to create or modify containers/profiles to share the host uid/gid namespace, weakening isolation guarantees and enabling cross-container DoS, integrity, or confidentiality attacks.
Affected products
- Canonical Incus before 7.3.0
Timeline
- 2026-07-30: disclosed: GitHub GHSA advisory published
- 2026-08-21: advisory: NVD record published
- 2026: patched: Fixed in version 7.3.0