Executive brief
Incus is a container and virtual machine manager used to deploy and manage system workloads. Prior to version 7.3.0, a restricted project user can escalate privileges and escape to the host by injecting security configuration overrides during cross-cluster instance migration. An attacker with access to a restricted project can execute arbitrary commands as root on the underlying host system.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the instance migration handler at cmd/incusd/instance_post.go. When migrating an instance to another cluster member, the handler applies user-supplied configuration overrides via maps.Copy() without enforcing project restrictions, allowing a restricted project user to inject security-critical keys like `security.privileged` and `raw.lxc`. On the target cluster member, the instance arrives as a cluster notification, which explicitly skips the AllowInstanceCreation authorization check. An attacker with low privileges (access to a restricted project) can send a POST request with migration=true and malicious config overrides to achieve privilege escalation and container escape. The fix in version 7.3.0 adds project restriction enforcement after config merging, similar to prior fixes for snapshot restore operations.
Affected products
- LXC Incus before 7.3.0
Timeline
- 2026-07-30: disclosed
- 2026-08-21: advisory: CVE-2026-62940 assigned and published on NVD
- 2026-07-30: patched: Version 7.3.0 released with fix