A critical authorization bypass in lxc Incus enables restricted project users to elevate privileges and escape container isolation during instance migration.

This is a missing authorization vulnerability where project-specific security restrictions are ignored during the migration of instances. An authenticated user can supply unauthorized configuration overrides, such as privileged security flags, to escalate their container status.

This flaw effectively nullifies the multi-tenancy security model of the Incus platform. With a CVSS score of 9.9, the impact is total, as it allows an attacker to bypass project boundaries and gain privileged access to the host system, leading to full infrastructure compromise.

Immediate Action: Apply the update to lxc Incus version 7.3.0 or later across all cluster members to enforce mandatory project restriction checks.

Proactive Monitoring: Monitor cluster migration logs for any configuration overrides that appear suspicious or originate from non-privileged project accounts.

Compensating Controls: Limit migration permissions to authorized administrative personnel only until the software update is applied to all nodes in the cluster.

Public Exploit Available: No

The ability to bypass project restrictions and achieve host escape is a catastrophic security failure. Organizations using Incus in multi-tenant environments must treat this as a high-priority patching task to maintain system integrity.