https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-08T17:15:09.262870+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-62941 fkie_cve-2026-62941 2026-10-08T17:15:09.680665+00:00

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check (`AllowInstanceCreation`) runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys (including `security.privileged`, `raw.lxc`, `raw.apparmor`) from the source instance are merged AFTER the check passes, bypassing all project restrictions on the target project. Version 7.3.0 patches the issue.

 https://vulnerability.circl.lu/vuln/opensuse-su-2026:11651-1 openSUSE-SU-2026:11651-1 — incus-7.4-1.1 on GA media 2026-10-08T17:15:09.680867+00:00

incus-7.4-1.1 on GA media

 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-62941 UBUNTU-CVE-2026-62941 2026-10-08T17:15:09.680923+00:00

Affected: Ubuntu:Pro:24.04:LTS: incus, Ubuntu:Pro:26.04:LTS: incus

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check (`AllowInstanceCreation`) runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys (including `security.privileged`, `raw.lxc`, `raw.apparmor`) from the source instance are merged AFTER the check passes, bypassing all project restrictions on the target project. Version 7.3.0 patches the issue.