CyberRota Analysis
AI-GeneratedPrior to version 7.3.0, Incus allows users to bypass project-level restrictions on container isolation by omitting the `security.idmap.isolated` key, leading to the creation of non-isolated containers that share the host's UID/GID map. This vulnerability undermines tenant isolation, potentially exposing sensitive data and increasing the risk of privilege escalation among co-tenant containers. Organizations using Incus for container management should prioritize upgrading to version 7.3.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Incus is a system container and virtual machine manager. Prior to version 7.3.0, project-level enforcement of `restricted.containers.privilege=isolated` can be trivially bypassed, allowing a user to create a non-isolated (shared host idmap) container in a project that is configured to forbid them. The restriction only rejects an explicitly set `security.idmap.isolated=false` (or empty) and fails to enforce anything when the key is omitted entirely. Because an unset `security.idmap.isolated` defaults to `false` (non-isolation), a user simply leaves the key out and obtains exactly the container state the restriction is meant to forbid. This defeats the tenant-isolation guarantee the restriction exists to provide. Containers in the project share the host uid/gid map instead of receiving unique, non-overlapping ranges, weakening the isolation boundary between co-tenant containers and the host. Version 7.3.0 patches the issue.