CVE-2026-55621: Incus has a project restriction bypass for custom volume copy across projects
Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to access secrets in custom volumes they are not authorized to access. Version 7.2.0 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Incusto a version that resolves this vulnerability.Fixed in 7.2.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs privileges to perform custom volume copying, plus knowledge of both a project name they cannot access and a custom volume name within that project. The issue is remotely reachable and requires no user interaction.
What information could be exposed?
An attacker can copy a custom volume from an unauthorized project into a new project, potentially gaining access to secrets stored in that volume. The provided information describes confidentiality impact, not integrity or availability impact.
Are deployments affected by default?
The issue affects Incus versions before 7.2.0 where custom volumes are used across projects. Exploitation specifically depends on an attacker being able to invoke custom volume copy operations and knowing the target project and volume names.
What should teams do if they cannot immediately upgrade?
Restrict custom volume copy permissions to trusted users and avoid allowing them to copy volumes across projects. Limit exposure of project and custom-volume names, since those names are required for exploitation.
How can I tell whether I am affected?
Instances running Incus before version 7.2.0 are affected. Review whether untrusted or lower-privileged users can copy custom volumes and whether sensitive data is stored in custom volumes in projects those users should not access.