CyberRota Analysis
AI-GeneratedInstances managed by Incus prior to version 7.3.0 are vulnerable due to a flaw in the project restriction check during instance copying, allowing dangerous configuration keys to be merged after the check passes. This can lead to unauthorized privilege escalation and security breaches in the target project. Organizations using Incus for container and virtual machine management should prioritize upgrading to version 7.3.0 to mitigate this critical vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check (`AllowInstanceCreation`) runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys (including `security.privileged`, `raw.lxc`, `raw.apparmor`) from the source instance are merged AFTER the check passes, bypassing all project restrictions on the target project. Version 7.3.0 patches the issue.