CVE-2026-115376: Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 Project Restriction Bypass via Custom Volume Copy

Q: Which deployments are exposed?

Deployments running Incus 7.0.1 before 7.0.2 or 7.2.0 before 7.5.0 are affected. The issue specifically affects environments where project-restricted clients can access the custom volumes endpoint.

Q: What access does an attacker need?

An attacker needs project-restricted client access and the ability to send crafted POST requests to the custom volumes endpoint. They can omit source.type and supply a chosen source.project.

Q: What could an attacker access?

A successful exploit can let the attacker copy and read volumes belonging to other projects. This can expose those projects' volumes, snapshots, and configuration.

Q: How can I determine whether exploitation may have occurred?

Review requests to the custom volumes endpoint for POST operations that omit source.type while specifying source.project. Such requests are the described method for copying data from another project.

Published Oct 22, 2026

Updated

Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type. Attackers can send crafted POST requests to the custom volumes endpoint with a chosen source.project to copy and read other projects' volumes, snapshots, and configuration.

Affected Software

1 affected component

Linux Containers Incus>=7.0.1<7.0.2, >=7.2.0<7.5.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Incus to a version that resolves this vulnerability.
Fixed in 7.0.2
Upgrade
Upgrade Incus to a version that resolves this vulnerability.
Fixed in 7.5.0

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments running Incus 7.0.1 before 7.0.2 or 7.2.0 before 7.5.0 are affected. The issue specifically affects environments where project-restricted clients can access the custom volumes endpoint.

What access does an attacker need?

An attacker needs project-restricted client access and the ability to send crafted POST requests to the custom volumes endpoint. They can omit source.type and supply a chosen source.project.

What could an attacker access?

A successful exploit can let the attacker copy and read volumes belonging to other projects. This can expose those projects' volumes, snapshots, and configuration.

How can I determine whether exploitation may have occurred?

Review requests to the custom volumes endpoint for POST operations that omit source.type while specifying source.project. Such requests are the described method for copying data from another project.

CVE-2026-115376: Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 Project Restriction Bypass via Custom Volume Copy

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What access does an attacker need?

What could an attacker access?

How can I determine whether exploitation may have occurred?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What access does an attacker need?

What could an attacker access?

How can I determine whether exploitation may have occurred?