A critical authorization flaw in lxc Incus allows authenticated users to bypass security restrictions by injecting malicious configuration keys during cross-project instance copying.

The vulnerability occurs because the system performs the authorization check before merging the source instance configuration. An authenticated user can exploit this race-like condition in logic to introduce dangerous configuration keys that would otherwise be rejected by the target project's security policy.

By bypassing project restrictions, an attacker can deploy privileged containers or utilize sensitive configuration keys to escape the container environment. The CVSS score of 9.9 reflects the total impact on confidentiality, integrity, and availability, posing a significant risk to any organization relying on Incus for workload isolation.

Immediate Action: Update lxc Incus to version 7.3.0 or later to ensure that security configuration checks are performed after merging instance definitions.

Proactive Monitoring: Review audit logs for unusual instance creation or copy events that involve sensitive configuration keys.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) to limit the ability of users to perform cross-project instance operations until the patch is deployed.

Public Exploit Available: No

Given the existence of a proof-of-concept and the critical nature of this authorization bypass, immediate patching is required. Administrators should prioritize this update to prevent unauthorized privilege escalation and maintain the security boundaries of their containerized environments.