CVE-2026-62940

CVE-2026-62940 represents a fundamental authorization bypass in Incus where configuration overrides during instance migration circumvent project-level security restrictions that are enforced at every other interaction point. The vulnerability is straightforward in isolation: user-supplied config in the migration path slips through without routing through the same project restriction checks that govern instance creation and modification. The project-level flags security.privileged and raw.lxc are rendered ineffective precisely when an instance moves between nodes. The deeper failure is architectural, not mechanical. Incus appears to have implemented security enforcement as inline checks scattered across specific code paths rather than as a centralized policy layer that any configuration application must traverse. This creates what amounts to a security surface drift problem: new operational pathways bypass the enforcement model by default because there is no central enforcement point demanding compliance. The migration code was almost certainly built by developers reasoning about instance mobility and cluster state, not about the authorization model — and that implicit assumption is precisely what the vulnerability exploits. The CVSS 9.9 is technically justified for container escape, but it masks a critical context: successful exploitation requires valid cluster membership authentication and migration initiation access. That is precisely the access tier where most organizations treat infrastructure code paths as implicitly trusted. The question for defenders is not merely whether they have patched 7.3.0 — it is whether cluster membership authentication in their deployment is appropriately hardened, because cluster membership becomes the actual security primitive once this bypass exists. Remediation priorities: first, verify that 7.3.0 is applied and confirm the migration config application path now routes through project restriction enforcement. Second, audit all other inter-node operational pathways — live migration state transfer, cross-node snapshots, backups, live updates — to determine whether they share the same implicit trust pattern. Third, treat the architectural question as unresolved: if project restrictions are still enforced through inline checks rather than a centralized policy layer, every future operational pathway added to Incus carries the same bypass risk. The targeted patch closes this vector; only a structural refactor toward centralized enforcement closes the vulnerability class.

Reviewed through automated stages and approved by a human before publication.