CVE-2026-62941: Incus Cross-Project Copy Privilege Escalation (CVSS 9.9)

Overview

A second critical vulnerability (CVSS 9.9) has been disclosed in Incus, tracked as CVE-2026-62941. This time-of-check/time-of-use (TOCTOU) flaw allows a user in a restricted project to copy a privileged instance into their project, bypassing the AllowInstanceCreation project restriction check by exploiting the order of operations during cross-project instance copying.

Affected versions: Incus prior to 7.3.0. The fix is available in Incus 7.3.0.

Vulnerability Details

When copying an instance across projects, Incus runs the AllowInstanceCreation restriction check before the source instance's configuration is merged into the copy request. This creates a TOCTOU window:

1. The restriction check validates the initial (potentially safe) request parameters.
2. The source instance's configuration — which may include security.privileged: true or dangerous raw.lxc directives — is then merged into the new instance after the check has already passed.
3. The destination instance is created with the privileged configuration, bypassing the project's security policy.

Root Cause

The vulnerability is a sequencing error in Incus's instance copy pipeline. The correct order is:

merge source config → validate against project restrictions → create instance

The vulnerable code performs:

validate against project restrictions → merge source config → create instance

This means the validation step never sees the dangerous configuration keys that will actually be applied.

Impact

• Privilege escalation — restricted project users can create privileged containers equivalent to containers in unrestricted projects.
• Container escape — a privileged Incus container maps UID 0 inside the container to UID 0 on the host, enabling full host access.
• Exploitation requires access to any Incus project and the ability to initiate cross-project copies.

Affected Products

Remediation

Update Incus to version 7.3.0 or later. The patch reorders the copy pipeline so that project restriction checks occur after the source instance configuration has been fully merged, eliminating the TOCTOU window.

# Check current Incus version
incus version
 
# Update via snap
snap refresh incus
 
# Or via apt (if using the Zabbly repository)
apt update && apt install incus

Where an immediate upgrade is not feasible, restrict cross-project copy permissions to trusted administrators using Incus fine-grained authorization.

Relationship to CVE-2026-62940

CVE-2026-62940 and CVE-2026-62941 were disclosed together and both affect Incus prior to 7.3.0. CVE-2026-62940 targets the migration pathway; CVE-2026-62941 targets the cross-project copy pathway. Both result in the same class of impact — privilege escalation via bypassed project restrictions — and share the same fix version.

References

• NVD — CVE-2026-62941
• Incus Project
• Incus 7.3.0 Release Notes