CVE-2026-62940: Incus Migration Security Restriction Bypass (CVSS 9.9)

Overview

A critical privilege escalation vulnerability (CVSS 9.9) has been disclosed in Incus, the open-source system container and virtual machine manager forked from LXD. The flaw, tracked as CVE-2026-62940, allows an attacker with access to a restricted project to bypass security controls during cross-cluster instance migration and gain elevated privileges on the target cluster.

Affected versions: Incus prior to 7.3.0. The fix is available in Incus 7.3.0.

Vulnerability Details

When migrating an instance to another cluster member, Incus accepts user-supplied configuration overrides as part of the migration request. The vulnerability arises because these overrides — which can include security-critical keys such as security.privileged and raw.lxc — are applied to the migrated instance without enforcing project-level restrictions.

This means a user operating within a restricted project (where security.privileged would normally be blocked) can supply the key as a migration override and have it silently accepted, effectively escaping the project's security boundary.

Affected Configuration Keys

The following keys can be injected via the migration override pathway:

Attack Scenario

1. Attacker has access to a restricted Incus project with security.privileged = false enforced.
2. Attacker initiates a cross-cluster migration, injecting security.privileged: true as a configuration override.
3. The destination cluster applies the override without checking project restrictions.
4. The migrated container runs as privileged, giving the attacker root-equivalent access on the host.

Impact

• Privilege escalation from restricted project user to root on the target cluster member.
• Potential container escape via the security.privileged key — a privileged container has near-full host access.
• Exploitation requires a valid Incus cluster account with permission to migrate instances; it does not require external network access.

Affected Products

Remediation

Update Incus to version 7.3.0 or later. The fix enforces project restriction checks on all user-supplied configuration overrides at the point of application during migration, regardless of the request pathway.

# Check current Incus version
incus version
 
# Update via your package manager (e.g. snap)
snap refresh incus

If an immediate upgrade is not possible, restrict cluster migration permissions to trusted administrators only using Incus RBAC controls.

References

• NVD — CVE-2026-62940
• Incus Project
• Incus 7.3.0 Release Notes