https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T13:01:02.972839+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-55621 CVE-2026-55621 — Incus has a project restriction bypass for custom volume copy across projects 2026-09-30T13:01:03.977214+00:00

Affected: lxc incus

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to access secrets in custom volumes they are not authorized to access. Version 7.2.0 patches the issue.

 https://vulnerability.circl.lu/vuln/ghsa-64f3-v33m-w89f GHSA-64f3-v33m-w89f — Incus has a project restriction bypass for custom volume copy across projects 2026-09-30T13:01:03.977358+00:00

Affected: Go: github.com/lxc/incus/v7, Go: github.com/lxc/incus/v6, Go: github.com/lxc/incus

### Summary

Missing authorization checks exist for custom volume copying where an attacker who knows the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to access secrets in custom volumes they are not authorized to access.

### Details

The storage volume creation handler authorizes creation in the target project, then passes `req.Source.Project` into the custom-volume copy path without checking that the caller can view the source volume. `req.Source.Project` is the attacker-controlled field. It is resolved to a storage volume project name and passed directly to `CreateCustomVolumeFromCopy`. No `allowPermission` or entitlement check (e.g. `CanView` on the source volume) is performed.

The copy must occur on the same server. However, once the copy has been done, nothing prevents a malicious actor from moving the volume to another server.

### PoC #### Setup

Assume the target server is remotely accessible and a user/certificate has been added.

``` # create a new project and instance incus project create secrets incus profile show default | incus --project secrets edit default incus --project secrets storage volume create default secret-vol

# restrict an existing certificate to prevent access to the project incus config trust edit cert-fp #> set, for example restricted: true projects: - default

# verification, with the restricted certificate i…