CVE-2026-62940: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-62940 is a critical project restriction bypass vulnerability in Incus, the open-source container and virtual machine manager, that allows a restricted project user to escalate privileges and escape to the host. The vulnerability exists in the instance migration handler, which applies user-supplied configuration overrides — including security-critical keys like security.privileged and raw.lxc — without any project restriction enforcement. It affects all versions of github.com/lxc/incus/v7/cmd/incusd prior to v7.3.0, and was patched on July 30, 2026. It carries a CVSS v3.1 base score of 9.9 (Critical) (GitHub Advisory).

The root cause is CWE-862 (Missing Authorization): the instance migration handler at cmd/incusd/instance_post.go:631 applies user-supplied config overrides via maps.Copy(targetInstInfo.Config, req.Config) with no calls to project.AllowInstanceCreation, project.AllowInstanceUpdate, or any restriction-checking function (GitHub Advisory). The InstancePost API struct (defined in shared/api/instance.go:116-129, API extension instance_move_config) accepts arbitrary Config, Devices, and Profiles fields. Compounding the issue, when the migrated instance is recreated on the target cluster member via a cluster notification, the AllowInstanceCreation check at instances_post.go:1437 is explicitly skipped for cluster notifications (if !clusterNotification). The fix, merged in PR #3750, adds project restriction enforcement in instance_post.go after the config merge (GitHub PR).

Successful exploitation results in a full container escape from a restricted project on any clustered Incus deployment, granting the attacker arbitrary command execution on the host as root. An attacker can set security.privileged=true and inject arbitrary raw.lxc mount entries (e.g., bind-mounting the host root filesystem into the container), achieving complete confidentiality, integrity, and availability compromise of the underlying host. This enables lateral movement across the cluster and full access to all data and workloads on the affected host (GitHub Advisory).

The vulnerability requires an authenticated attacker with access to a restricted project on a multi-member Incus cluster, making the privilege requirement low but not zero. No public exploit code or in-the-wild exploitation has been reported as of the time of disclosure. The CVE was responsibly disclosed by Zhixi "Jace" Sun (@manus-use) and patched the same day it was published (July 30, 2026). CISA KEV catalog status and EPSS score are not yet available for this CVE (GitHub Advisory).

1. Precondition: Obtain access to a restricted project on an Incus cluster with two or more members.
2. Create or identify an instance: Ensure you have an existing instance within the restricted project that can be migrated.
3. Craft malicious migration request: Send a POST /1.0/instances/{name}?target=node2 API request with a JSON body that includes security-bypassing config overrides:

{
  "migration": true,
  "config": {
    "security.privileged": "true",
    "raw.lxc": "lxc.mount.entry=/ /mnt none rbind 0 0"
  }
}

4. Bypass restriction check: The maps.Copy at line 631 of instance_post.go overwrites the instance config with the attacker-supplied values — no restriction check is performed.
5. Cluster notification bypass: The target node receives a cluster notification to recreate the instance; the AllowInstanceCreation check is explicitly skipped for cluster notifications at instances_post.go:1437.
6. Start the privileged container: Start the migrated instance, which now runs as a privileged container with the host root filesystem bind-mounted at /mnt.
7. Escape to host: Access /mnt inside the container to read/write the host filesystem, install backdoors, or execute commands as root on the host (GitHub Advisory, GitHub PR).

• Network: Unexpected POST /1.0/instances/{name} API requests with a target= query parameter originating from restricted project users, especially containing config fields with security.privileged or raw.lxc keys.
• Logs: Incus daemon logs showing instance migration events where the resulting instance config contains security.privileged=true or raw.lxc entries not present in the original instance; cluster notification logs for instance creation that skip restriction checks.
• File System: Unexpected bind mounts of the host root filesystem (e.g., /mnt inside a container mapped to / on the host); new files or cron jobs created in host directories via the container's /mnt path.
• Process: Privileged container processes (running without user namespace isolation) spawned from instances that were previously in restricted projects; unexpected root-owned processes originating from container namespaces.

Upgrade Incus to version v7.3.0 or later, which includes the fix merged in PR #3750 on July 30, 2026 (GitHub PR). The patch adds project restriction enforcement in instance_post.go after maps.Copy applies config overrides, validating the merged config against project restrictions before proceeding. No configuration-based workaround is available; the only effective mitigation is upgrading to the patched version. As an interim measure, administrators can restrict API access to trusted users only and monitor for unexpected migration requests from restricted project users (GitHub Advisory).

The vulnerability was responsibly disclosed by Zhixi "Jace" Sun (@manus-use) and patched by Incus maintainer Stéphane Graber on the same day it was published. The fix was included in the Incus 7.3 security release, announced on the maintainer's blog (stgraber.org). AusCERT published a bulletin (ESB-2026.8926) covering the advisory. Tenable released Nessus detection plugins (IDs 331527 and 331515) for the vulnerability (Tenable).