CVE-2026-62313
Incus is a system container and virtual machine manager.
Published Aug 21, 2026 · updated Oct 15, 2026
Incus is a system container and virtual machine manager. Prior to version 7.3.0, project-level enforcement of can be trivially bypassed, allowing a user to create a non-isolated (shared host idmap) container in a project that is configured to forbid them. The restriction only rejects an explicitly set (or empty) and fails to enforce anything when the key is omitted entirely. Because an unset defaults to (non-isolation), a user simply leaves the key out and obtains exactly the container state the restriction is meant to forbid. This defeats the tenant-isolation guarantee the restriction exists to provide. Containers in the project share the host uid/gid map instead of receiving unique, non-overlapping ranges, weakening the isolation boundary between co-tenant containers and the host. Version 7.3.0 patches the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Aug 21, 2026 · NIST NVD
Detected
Incus is a system container and virtual machine manager. Prior to version 7.3.0, project-level enforcement of can be trivially bypassed, allowing a user to create a non-isolated (shared host idmap) container in a project that is configured to forbid them. The restriction only rejects an explicitly set (or empty) and fails to enforce anything when the key is omitted entirely. Because an unset defau
Oct 15, 2026 · NIST NVD
Updated
Incus is a system container and virtual machine manager. Prior to version 7.3.0, project-level enforcement of can be trivially bypassed, allowing a user to create a non-isolated (shared host idmap) container in a project that is configured to forbid them. The restriction only rejects an explicitly set (or empty) and fails to enforce anything when the key is omitted entirely. Because an unset defau
Sources
- CVE.orgVulnerability recordCVE-2026-62313
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-62313
Incus is a system container and virtual machine manager. Prior to version 7.3.0, project-level enforcement of can be trivially bypassed, allowing a user to create a non-isolated (shared host idmap) container in a project that is configur
nvd.nist.gov