CVE-2026-62940
Received Received - Intake

Privileged Container Escape in Incus via Project Restriction Bypass

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configuration overrides (including security-critical keys like `security.privileged` and `raw.lxc`) are applied without any project restriction enforcement, allowing a restricted project user to escalate to a privileged container and escape to the host. Version 7.3.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-62940
EUVD
EUVD-2026-63950

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
incus system_container to 7.3.0 (exc)
canonical incus to 7.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-62940 is a critical security flaw in Incus (a container and VM manager) that allows a restricted user to bypass project restrictions during instance migration in a multi-node cluster. The vulnerability occurs because user-supplied configuration overrides, including security-sensitive settings like privileged mode, are applied without enforcing project restrictions. This enables privilege escalation, container escape, and full root access to the host system.

Detection Guidance

Check Incus version with 'incus version' to confirm if it is below 7.3.0. Inspect cluster members and migration logs for unauthorized config overrides. Look for instances with security.privileged or raw.lxc settings enabled in restricted projects.

Impact Analysis

If you use Incus in a multi-member cluster with restricted projects, an attacker with access to a restricted project could exploit this to gain root access on the host system. This could allow them to execute arbitrary commands, steal data, or compromise other containers and VMs on the host.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) and HIPAA (health information privacy). A successful exploit may result in data breaches, unauthorized disclosure, or loss of control over critical systems, leading to regulatory penalties and reputational damage.

Mitigation Strategies

Upgrade Incus to version 7.3.0 or later immediately. Disable cross-member instance migrations until patched. Review and remove any instances with privileged configurations in restricted projects.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62940. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart