ZeroDay Findings
Sign inSign up

Findings

CVE-2026-62940

Incus is a system container and virtual machine manager.

Published Aug 21, 2026 · updated Oct 15, 2026

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configuration overrides (including security-critical keys like and ) are applied without any project restriction enforcement, allowing a restricted project user to escalate to a privileged container and escape to the host. Version 7.3.0 patches the issue.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 21, 2026 · NIST NVD

    Detected

    Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configuration overrides (including security-critical keys like and ) are applied without any project restriction enforcement, allowing a restricted project user to escalate to a privileged container and escape to the host. Version 7.3.0 patches the is

  2. Oct 15, 2026 · NIST NVD

    Updated

    Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configuration overrides (including security-critical keys like and ) are applied without any project restriction enforcement, allowing a restricted project user to escalate to a privileged container and escape to the host. Version 7.3.0 patches the is

Sources

  • CVE.orgVulnerability recordCVE-2026-62940

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-62940

    Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configuration overrides (including security-critical keys like and ) are applied without any project

    nvd.nist.gov

References