CVE-2026-62941
Incus is a system container and virtual machine manager.
Published Aug 21, 2026 · updated Oct 15, 2026
Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check ( ) runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys (including , , ) from the source instance are merged AFTER the check passes, bypassing all project restrictions on the target project. Version 7.3.0 patches the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Aug 21, 2026 · NIST NVD
Detected
Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check ( ) runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys (including , , ) from the source instance are merged AFTER the check passes, bypassing all project restrictions on the target project. Ver
Oct 15, 2026 · NIST NVD
Updated
Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check ( ) runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys (including , , ) from the source instance are merged AFTER the check passes, bypassing all project restrictions on the target project. Ver
Sources
- CVE.orgVulnerability recordCVE-2026-62941
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-62941
Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check ( ) runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration k
nvd.nist.gov