CVE-2026-62941: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-62941 is a project restriction bypass vulnerability in Incus (a system container and virtual machine manager) that allows an authenticated attacker to escape security restrictions via a cross-project instance copy operation. The vulnerability affects all Incus versions prior to v7.3.0 (upstream) and is fixed in Debian package version 6.0.4-2+deb13u9. It carries a CVSS v3.1 base score of 9.9 (Critical), reflecting its network-exploitable, low-complexity nature with high impact across confidentiality, integrity, and availability (GitHub Advisory). The vulnerability was discovered by Zhixi "Jace" Sun (@manus-use) and patched on July 30, 2026 (GitHub PR #3750).

The root cause is an incorrect authorization check (CWE-863) in cmd/incusd/instances_post.go. When copying an instance across projects, AllowInstanceCreation() validates the request against the target project's restrictions before the source instance's configuration is merged into the request object. Dangerous keys — including security.privileged, raw.lxc, and raw.apparmor — are merged into req.Config inside createFromCopy() after the restriction check passes, meaning the final merged configuration is never validated against the target project's policy. The backup restore path in the same file does perform a post-merge restriction check, making the omission in the copy path an oversight. The fix adds a late restriction check in createFromCopy() after the source config merge, mirroring the backup restore path's validation (GitHub Advisory, GitHub PR #3750).

Successful exploitation results in a full container escape from a restricted project. An attacker who can view an instance in an unrestricted (or less-restricted) project and create instances in a restricted target project can instantiate a privileged container — with security.privileged=true or arbitrary raw.lxc/raw.apparmor hooks — within the restricted project, bypassing all project-level security controls. This enables host-level privilege escalation, lateral movement to other containers or the host system, and full compromise of confidentiality, integrity, and availability of the affected environment (GitHub Advisory).

The CVE status is listed as Reserved with no public NVD entry yet, and no evidence of in-the-wild exploitation or public exploit code has been reported. The CVSS score of 9.9 reflects that exploitation requires only low privileges (CanView on a source instance and CanCreateInstances in a restricted project) over the network with no user interaction. No EPSS score or CISA KEV catalog entry is currently available for this CVE. The vulnerability was responsibly disclosed by the discoverer and patched before broad public disclosure (GitHub Advisory, Feedly).

1. Reconnaissance: Identify an Incus deployment running a version prior to v7.3.0 where the attacker has at least two project roles: CanView on an instance in an unrestricted (or less-restricted) project, and CanCreateInstances in a restricted target project.
2. Identify a privileged source instance: Locate or arrange for a source instance in the unrestricted project that has dangerous configuration keys set, such as security.privileged=true, raw.lxc hooks, or raw.apparmor overrides.
3. Initiate cross-project copy: Send a crafted API request to the Incus daemon targeting the restricted project:

   POST /1.0/instances?project=restricted-project
   {
     "name": "evil",
     "source": {
       "type": "copy",
       "source": "priv-container",
       "project": "unrestricted-project"
     }
   }

4. Bypass restriction check: AllowInstanceCreation() evaluates the request while req.Config is still empty, so the check passes without detecting the dangerous keys.
5. Config merge occurs post-check: createFromCopy() merges the source instance's config (including security.privileged=true) into the new instance's configuration after the restriction check has already passed.
6. Start the privileged container: Launch the newly created instance in the restricted project. Because it carries security.privileged=true, it runs as a privileged container, enabling host escape and full system compromise (GitHub Advisory, GitHub PR #3750).

• Logs: Incus daemon logs showing a POST /1.0/instances?project=<restricted-project> request with source.type=copy and source.project pointing to a different project; audit logs showing instance creation in a restricted project with security.privileged=true or raw.lxc keys present in the final config.
• Configuration Artifacts: Instances in restricted projects with security.privileged=true, raw.lxc, or raw.apparmor configuration keys that should be blocked by project restrictions — detectable via incus config show <instance>.
• Process Behavior: Privileged container processes running without user namespace mapping (UID 0 on host) in projects where restricted.containers.privilege is enforced; unexpected root-owned processes spawned from container namespaces.
• Network: Unexpected API calls to the Incus socket or HTTPS API from authenticated users performing cross-project copy operations at unusual times or frequencies.

Upgrade Incus to version v7.3.0 or later (upstream), which adds a post-merge restriction check in createFromCopy() to validate the final merged configuration against the target project's restrictions. Debian users should upgrade to package version 6.0.4-2+deb13u9 or later. As a workaround where upgrading is not immediately possible, restrict cross-project copy permissions by ensuring that no user has simultaneous CanView access to instances in unrestricted projects and CanCreateInstances access in restricted projects. Audit existing instances in restricted projects for unexpected privileged configuration keys (GitHub Advisory, GitHub PR #3750, Feedly).

The vulnerability was disclosed alongside a batch of 17 security fixes for Incus 7.3, published by lead maintainer Stéphane Graber on July 30, 2026. The Incus 7.2.2 announcement blog post by Graber also referenced the security fixes (stgraber.org). AusCERT published a bulletin (ESB-2026.8926) covering the Debian advisory. Tenable released Nessus detection plugins (IDs 331515 and 331532) for the affected Debian packages shortly after disclosure (Tenable).