Incus has a project restriction bypass in instance copy across projects
Priority HIGH 67CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284.
Summary
Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new project. This issue could allow an attacker to access secrets in instances they are not authorized to access. Version 7.2.0 patches the issue.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00454 39th percentileScored 2026-11-07
Fix Fixed incus (lxc): 7.2.0lxd (canonical): 5.0.7, 6.8.0+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| lxc | incus | before 7.2.0 | 7.2.0 | Patch available | CNA |
| Canonical | lxd | 4.12.0 to before 5.0.7; >= 5.1.0, 5.21.5; 6.0.0 to before 6.8.0 | 5.0.7, 6.8.0 | Patch available | CNA |
| — | github.com/lxc/incus/v7/cmd/incusd (Go) | before 7.2.0 | 7.2.0 | Patch available | GHSA-c9f5-j9c3-mhrg |
| — | github.com/lxc/incus/v7 (Go) | before 7.2.0 | 7.2.0 | Patch available | GHSA-c9f5-j9c3-mhrg |
- incus Vendorlxc Affected before 7.2.0 Fixed in 7.2.0 Patch available CNA
- lxd VendorCanonical Affected 4.12.0 to before 5.0.7; >= 5.1.0, 5.21.5; 6.0.0 to before 6.8.0 Fixed in 5.0.7, 6.8.0 Patch available CNA
- github.com/lxc/incus/v7/cmd/incusd (Go) Vendor— Affected before 7.2.0 Fixed in 7.2.0 Patch available GHSA-c9f5-j9c3-mhrg
- github.com/lxc/incus/v7 (Go) Vendor— Affected before 7.2.0 Fixed in 7.2.0 Patch available GHSA-c9f5-j9c3-mhrg
Remediation
- Fix · CNA incus (lxc) Fixed in 7.2.0
- Fix · CNA lxd (canonical) Fixed in 5.0.7, 6.8.0
- Fix · GHSA-c9f5-j9c3-mhrg github.com/lxc/incus/v7/cmd/incusd (Go) Fixed in 7.2.0 Advisory →
- Fix · GHSA-c9f5-j9c3-mhrg github.com/lxc/incus/v7 (Go) Fixed in 7.2.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-55622
- 2026-10-03 Alias added: GHSA-c9f5-j9c3-mhrg
- 2026-11-05 Fix available: Go/github.com/lxc/incus/[email protected] · GHSA-c9f5-j9c3-mhrg
- 2026-11-05 1 new reference · GHSA-c9f5-j9c3-mhrg
- 2026-11-05 5 new references · CNA
- 2026-11-05 Affected versions changed · GHSA-c9f5-j9c3-mhrg
- 2026-11-05 Affected versions changed · CNA
References
Other 7
- https://github.com/lxc/incus/security/advisories/GHSA-c9f5-j9c3-mhrg
- https://github.com/canonical/lxd/security/advisories/GHSA-qx75-2p3r-pwm5
- https://github.com/lxc/incus/pull/3542
- https://github.com/lxc/incus/commit/1e3ffc53a10950e55de62ac1e0d612be597b84eb
- https://discuss.linuxcontainers.org/t/incus-7-2-has-been-released/26879
- https://github.com/lxc/incus/releases/tag/v7.2.0
- https://github.com/lxc/incus
More lxc vulnerabilities
- TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
- TI-2026-45063 Incus vulnerable to root RCE via image backup.yaml symlink CVSS 3.1CRITICAL 9.9
- TI-2026-44978 Incus: Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge CVSS 3.1CRITICAL 9.9
- TI-2026-36039 Incus has an arbitrary file write on its client due to trusted image hash CVSS 3.1CRITICAL 9.9
- TI-2026-36024 Incus has an arbitrary file write via path traversal in S3 multipart upload CVSS 3.1CRITICAL 9.9
- TI-2026-36022 Incus has a restricted project bypass leading to arbitrary command execution CVSS 3.1CRITICAL 9.9
Sources
- CVE-2026-55622 · CVE Program
- CVE-2026-55622 · NVD
- FIRST EPSS
- GHSA-c9f5-j9c3-mhrg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences