External risk intelligence

Incus Project Privilege Escalation Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-62940

Incus is a system container and virtual machine manager typically deployed within internal data center or private cloud infrastructure. While it manages containers, it is not designed to be exposed directly to the public internet, and administrative or restricted project user access is generally restricted to authorized internal personnel.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Incus, a system for managing containers and virtual machines. The issue allows a restricted user to gain elevated privileges and potentially escape to the host system when migrating instances between cluster members, as prior versions did not properly restrict the application of user-supplied configurations. The primary concern is confirming if this technology is in use and if so, understanding the scope of exposure.

Unrestricted configurations can allow privilege escalation.
Restricts user actions during instance migration.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker with restricted access to Incus, a system container and virtual machine manager, could exploit this vulnerability by migrating an instance to another cluster member. During this migration, the system fails to properly check user-supplied configuration overrides. This oversight allows a restricted user to inject malicious configurations, such as setting `security.privileged` to true or altering `raw.lxc` settings, which can lead to escalating their access to a privileged container and subsequently escaping to the host system.

Requires restricted project user access.
Triggered during instance migration.
Allows privilege escalation and host escape.

Live Threat

Current exploitation, exposure, and threat context

When Incus instances are migrated, user-supplied configuration overrides that bypass project restrictions could allow a restricted user to gain privileged container access and potentially escape to the host. This scenario is supported when the advisory's conditions for applying these overrides are met.

Instance data and host system access.
Migrating instances with unvalidated configurations.
Host system compromise by a restricted user.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Incus impacts its instance migration functionality. Application owners and platform teams responsible for managing Incus deployments should prioritize identifying all instances, assessing their reachability and business criticality, and confirming the owner of any affected systems. Subsequent remediation planning should be risk-based, potentially involving vendor coordination or temporary mitigations if immediate patching is not feasible.

Ownership: Platform or infrastructure teams.
Verify first: Incus deployment scope and reachability.
Action: Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Incus and how is it used?

Incus is an open-source system container and virtual machine manager. It provides a unified interface for IT teams to manage complex workloads across clusters of servers. It is commonly used in private cloud environments and data centers to isolate applications and services within containers or virtual machines, ensuring efficient resource management and system portability.

What does CWE-862 mean for CVE-2026-62940?

CWE-862 refers to Missing Authorization. In the context of this vulnerability, it means the software fails to verify if a user has the proper permissions before performing a sensitive action. Specifically, when migrating instances, Incus does not check if a user is allowed to apply certain security configurations, letting restricted users bypass intended access controls.

How is this Incus vulnerability triggered?

An attacker triggers this by initiating the migration of an instance to another cluster member while using malicious configuration overrides. Crucially, simply running an instance or performing standard management tasks does not trigger the bug; the escalation only occurs when the system fails to enforce project restrictions during the migration process itself.

Is my organization at risk from CVE-2026-62940?

Halo Surface Signal indicates that Incus is typically deployed within internal, private infrastructure rather than being exposed to the public internet. Because the vulnerability requires an attacker to already have restricted project user access, the primary risk is from authorized insiders or accounts that have been compromised. Systems in isolated networks face lower immediate threat.

What should I do if I manage Incus?

First, verify your current version of Incus. If you are running any version prior to 7.3.0, you are affected and should prioritize updating to version 7.3.0 or later to patch the migration logic. Coordinate with your platform or infrastructure teams to identify all active instances and schedule a maintenance window to apply the update across your cluster.

References

github.com/lxc/incus/security/advisories/GHSA-qw5c-v953-38gw

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.