CVE-2026-55622: Incus has a project restriction bypass in instance copy across projects
Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new project. This issue could allow an attacker to access secrets in instances they are not authorized to access. Version 7.2.0 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.2.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Incus deployments running versions earlier than 7.2.0 are affected when a user can perform instance-copy operations and can identify both a project they cannot access and an instance name within that project.
What does an attacker need to exploit the bypass?
The attacker needs low-privileged access and knowledge of the target project name and an instance name in that project. No user interaction is required.
What is the impact of a successful copy?
An attacker can copy an instance from an unauthorized project into a new project, potentially gaining access to secrets contained in that instance.
How can this be remediated?
Upgrade Incus to version 7.2.0, which patches the missing authorization checks for cross-project instance copying.