Privilege Escalation in Incus Container Management Software by LXD

CVE-2026-62941

What is CVE-2026-62941?

Prior to version 7.3.0, Incus, a system container and virtual machine manager, has a vulnerability that allows bypassing project restrictions during instance copying. Specifically, the project restriction check for AllowInstanceCreation is executed before the configuration of the source instance is merged into the request. As a result, potentially insecure configuration keys, including security.privileged, raw.lxc, and raw.apparmor, are applied only after this check, enabling an attack vector that compromises the integrity of the target project. This flaw poses a significant risk to environments utilizing Incus for container management.

References