CVE-2026-62941
Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check (AllowInstanceCreation) runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys (including security.privileged, raw.lxc, raw.apparmor) from the source instance are merged AFTER the check passes, bypassing all project restrictions on the target project. Version 7.3.0 patches the issue.
CSIRTS triage
- What
- Multiple security issues in Incus allow bypass of security restrictions and privilege escalation.
- Who is affected
- Systems running Incus container and virtual machine manager.
- Urgency
- High; privilege escalation and security bypass are critical risks.
- Action
- Update Incus to the patched version referenced in DSA-6407-1.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-62941
Get an email if CVE-2026-62941 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.25% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 16% of all EPSS-scored CVEs.
Advisory coverage (2)
- criticalCVE-2026-62941: Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying …nvd · 2026-08-21
- unknownDSA-6407-1 incus - security updatedebian · 2026-07-31
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-62941)