CVE-2026-62940 lxc CVE debrief

Who should care

System administrators and security teams responsible for managing Incus instances and ensuring the security of their container and virtual machine infrastructure should assess their exposure and take necessary actions to mitigate the vulnerability.

Why it matters

CVE-2026-62940 is a critical vulnerability in Incus that allows restricted project users to escalate privileges and escape to the host. Defenders should prioritize verifying and upgrading to Incus version 7.3.0 or later, and restrict project user access to sensitive configuration overrides.

• Potential privilege escalation for restricted project users
• Possible container escape to the host
• Need for verification of Incus version and configuration
• Priority on upgrading to version 7.3.0 or later

Technical summary

The vulnerability in Incus allows a restricted project user to escalate to a privileged container and escape to the host due to improper enforcement of project restrictions on user-supplied configuration overrides during instance migration. This occurs when migrating an instance to another cluster member, where user-supplied configuration overrides, including security-critical keys like `security.privileged` and `raw.lxc`, are applied without project restriction enforcement. Defenders should prioritize verifying and upgrading to Incus version 7.3.0 or later and restrict project user access to sensitive configuration overrides. The issue was patched in version 7.3.0.

Defensive priority

Defenders should prioritize verifying and upgrading to Incus version 7.3.0 or later, and restrict project user access to sensitive configuration overrides.

Recommended defensive actions

• Verify Incus version and upgrade to 7.3.0 or later
• Restrict project user access to sensitive configuration overrides
• Monitor for suspicious activity related to instance migration
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, and a GitHub advisory offers additional context. The vulnerability allows a restricted project user to escalate to a privileged container and escape to the host due to improper enforcement of project restrictions on user-supplied configuration overrides during instance migration. Defenders should verify Incus version, review configuration, and restrict project user access. Evidence is limited to public sources and may not reflect all affected systems or variations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.