CVE-2026-62940 in Incus
Summary
by MITRE • 08/21/2026
Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configuration overrides (including security-critical keys like `security.privileged` and `raw.lxc`) are applied without any project restriction enforcement, allowing a restricted project user to escalate to a privileged container and escape to the host. Version 7.3.0 patches the issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
Incus serves as a comprehensive system container and virtual machine manager designed for Linux environments, facilitating the orchestration of isolated computing resources across distributed clusters. A critical security flaw was identified in versions prior to 7.3.0 regarding the instance migration process between cluster members. This vulnerability stems from an insufficient access control mechanism during the transfer operation, where user-supplied configuration overrides are applied without enforcing project-level restrictions. The architectural design assumes that administrative privileges or strict policy enforcement would prevent unauthorized modifications to critical security settings during state transitions, but this assumption proved flawed in practice.
The technical flaw specifically affects security-critical configuration keys such as `security.privileged` and `raw.lxc`. When a user initiates the migration of an instance from one cluster member to another, the system accepts configuration overrides provided by the initiating user. In vulnerable versions, these overrides are applied directly without validating whether the user has permission within their assigned project scope to modify privileged settings. This lack of enforcement allows a restricted project user, who should be confined to non-privileged operations, to inject configurations that elevate the container's privileges. By setting `security.privileged` to true or injecting arbitrary LXC commands via `raw.lxc`, an attacker can break out of the container isolation boundaries and gain root-level access on the host system.
The operational impact of this vulnerability is severe, as it constitutes a direct privilege escalation path from a low-privileged user account to full control over the underlying host infrastructure. An adversary exploiting this flaw could execute arbitrary code with root privileges, bypass all security controls enforced by Incus projects, and potentially compromise other instances running on the same host or cluster members involved in the migration. This undermines the fundamental isolation guarantees provided by containerization technologies and poses a significant risk to multi-tenant environments where project-based access control is relied upon for tenant separation. The vulnerability aligns with CWE-269, which describes Improper Privilege Management, as it involves an actor obtaining elevated privileges without proper authorization checks during a specific operational workflow.
From the perspective of attack tactics and techniques, this exploitation scenario maps to MITRE ATT&CK technique T1078, Valid Accounts, specifically in the context of using legitimate credentials with insufficient permissions that are then escalated through misconfiguration or logic flaws. It also relates to T1610, Dive into Containers, as it involves escaping container isolation to access the host environment. The flaw highlights the importance of validating configuration changes against project policies not just at creation time but during all lifecycle operations including migration and updates.
To mitigate this vulnerability, organizations must upgrade Incus to version 7.3.0 or later immediately upon availability. This release includes patches that enforce strict project-based access control checks on configuration overrides applied during instance migrations. Until the upgrade is performed, administrators should restrict network exposure of Incus API endpoints and ensure that only trusted users with administrative privileges can initiate migration operations between cluster members. Additionally, implementing rigorous monitoring for unusual changes to `security.privileged` or `raw.lxc` settings within containers can help detect potential exploitation attempts in unpatched environments. Regular audits of project permissions and adherence to the principle of least privilege are essential practices to prevent similar logic flaws from being exploited in container orchestration platforms.