CVE-2026-62940 lxc CVE debrief

Who should care

Users of Incus system container and virtual machine manager, particularly those with restricted project user access, should be aware of this vulnerability and take steps to upgrade to version 7.3.0 or later. Additionally, operators, platform administrators, and security teams responsible for managing and securing Incus deployments should review the vulnerability details and assess their exposure.

Technical summary

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configuration overrides (including security-critical keys like `security.privileged` and `raw.lxc`) are applied without any project restriction enforcement, allowing a restricted project user to escalate to a privileged container and escape to the host. Version 7.3.0 patches the issue. The vulnerability has a CVSS score of 9.9 and a severity of CRITICAL.

Defensive priority

High

Recommended defensive actions

• Upgrade to version 7.3.0 or later
• Restrict project user access
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was obtained from the official CVE.org and NVD sources. The NVD entry is currently being reviewed. Further analysis is required to fully understand the vulnerability, including its potential impact on affected systems and the measures that can be taken to mitigate it. The vulnerability has a CVSS score of 9.9 and a severity of CRITICAL. Users should verify their deployments and assess their exposure.

Official resources