CVE-2026-62313

Name of the Vulnerable Software and Affected Versions Incus versions prior to 7.3.0

Description Project-level enforcement of restricted.containers.privilege=isolated can be bypassed, allowing a user to create a non-isolated container in a project configured to forbid them. The restriction only rejects an explicitly set security.idmap.isolated=false or an empty value, but fails to enforce the restriction when the key is omitted entirely. Since an unset security.idmap.isolated defaults to false, users can obtain a non-isolated container state by omitting the key. This results in containers sharing the host uid/gid map instead of receiving unique, non-overlapping ranges, which weakens the isolation boundary between co-tenant containers and the host.

Recommendations Update to version 7.3.0.