CVE-2026-62941

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-62941", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-14T22:32:17.731Z", "datePublished": "2026-08-21T14:47:56.724Z", "dateUpdated": "2026-08-21T16:44:16.507Z"}, "containers": {"cna": {"title": "Incus: Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/lxc/incus/security/advisories/GHSA-mq9x-prm8-3vpw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/lxc/incus/security/advisories/GHSA-mq9x-prm8-3vpw"}], "affected": [{"vendor": "lxc", "product": "incus", "versions": [{"version": "< 7.3.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-21T14:47:56.724Z"}, "descriptions": [{"lang": "en", "value": "Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check (`AllowInstanceCreation`) runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys (including `security.privileged`, `raw.lxc`, `raw.apparmor`) from the source instance are merged AFTER the check passes, bypassing all project restrictions on the target project. Version 7.3.0 patches the issue."}], "source": {"advisory": "GHSA-mq9x-prm8-3vpw", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/lxc/incus/security/advisories/GHSA-mq9x-prm8-3vpw", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T16:42:20.466737Z", "id": "CVE-2026-62941", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T16:44:16.507Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-62941", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-21T16:42:20.466737Z"}}}], "references": [{"url": "https://github.com/lxc/incus/security/advisories/GHSA-mq9x-prm8-3vpw", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T16:42:37.321Z"}}], "cna": {"title": "Incus: Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge", "source": {"advisory": "GHSA-mq9x-prm8-3vpw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "lxc", "product": "incus", "versions": [{"status": "affected", "version": "< 7.3.0"}]}], "references": [{"url": "https://github.com/lxc/incus/security/advisories/GHSA-mq9x-prm8-3vpw", "name": "https://github.com/lxc/incus/security/advisories/GHSA-mq9x-prm8-3vpw", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check (`AllowInstanceCreation`) runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys (including `security.privileged`, `raw.lxc`, `raw.apparmor`) from the source instance are merged AFTER the check passes, bypassing all project restrictions on the target project. Version 7.3.0 patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-21T14:47:56.724Z"}}}, "cveMetadata": {"cveId": "CVE-2026-62941", "state": "PUBLISHED", "dateUpdated": "2026-08-21T16:44:16.507Z", "dateReserved": "2026-07-14T22:32:17.731Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-21T14:47:56.724Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "incus", "vendor": "lxc", "versions": [{"status": "affected", "version": "< 7.3.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check (`AllowInstanceCreation`) runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys (including `security.privileged`, `raw.lxc`, `raw.apparmor`) from the source instance are merged AFTER the check passes, bypassing all project restrictions on the target project. Version 7.3.0 patches the issue."}, {"lang": "es", "value": "Incus es un gestor de contenedores de sistema y m\u00e1quinas virtuales. Antes de la versi\u00f3n 7.3.0, al copiar una instancia entre proyectos, la comprobaci\u00f3n de restricci\u00f3n de proyecto ('AllowInstanceCreation') se ejecuta ANTES de que la configuraci\u00f3n de la instancia de origen se fusione en la solicitud. Claves de configuraci\u00f3n peligrosas (incluyendo 'security.privileged', 'raw.lxc', 'raw.apparmor') de la instancia de origen se fusionan DESPU\u00c9S de que la comprobaci\u00f3n se aprueba, eludiendo todas las restricciones de proyecto en el proyecto de destino. La versi\u00f3n 7.3.0 corrige el problema."}], "id": "CVE-2026-62941", "lastModified": "2026-10-15T19:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62941", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T16:42:20.466737Z", "version": "2.0.3"}}]}, "published": "2026-08-21T15:16:46.287", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/lxc/incus/security/advisories/GHSA-mq9x-prm8-3vpw"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/lxc/incus/security/advisories/GHSA-mq9x-prm8-3vpw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "incus: Incus: Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge", "id": "2521017", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521017"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check (`AllowInstanceCreation`) runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys (including `security.privileged`, `raw.lxc`, `raw.apparmor`) from the source instance are merged AFTER the check passes, bypassing all project restrictions on the target project. Version 7.3.0 patches the issue.", "A flaw was found in Incus, a container and virtual machine manager. A race condition when copying instances across projects allows dangerous configuration keys to bypass project restrictions, enabling privilege escalation and container escape."], "mitigation": {"lang": "en:us", "value": "No mitigation is needed as Incus is not shipped in any Red Hat product."}, "name": "CVE-2026-62941", "public_date": "2026-08-21T14:47:56Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-62941\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-62941\nhttps://github.com/lxc/incus/security/advisories/GHSA-mq9x-prm8-3vpw"], "statement": "Incus is not shipped in any Red Hat product. The community Fedora package is affected.", "threat_severity": "Critical"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "incus", "source": "cna", "vendor": "lxc"}, "product": "incus", "vendor": "lxc"}], "created": "2026-08-21T16:30:06.807655+00:00", "updated": "2026-08-26T13:30:06.095313+00:00", "vendors": ["lxc", "lxc$PRODUCT$incus"]}