Vulnerability · Published Aug 21, 2026 · Assigned by GitHub_M
CVE-2026-55621Incus has a project restriction bypass for custom volume copy across projects
High 7.7
In plain English
A high-severity improper access control in lxd from canonical. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to access secrets in custom volumes they are not authorized to access. Version 7.2.0 patches the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | incus | 7.0.1-r0 | ALPINE-CVE-2026-55621 |
| Debian:13 | incus | 6.0.4-2+deb13u8 | DEBIAN-CVE-2026-55621 |
| Debian:14 | incus | 7.0.0-5 | DEBIAN-CVE-2026-55621 |
| Debian:12 | lxd | no fix listed | DEBIAN-CVE-2026-55621 |
| Debian:13 | lxd | 5.0.2+git20231211.1364ae4-9+deb13u7 | DEBIAN-CVE-2026-55621 |
| Go | github.com/lxc/incus | no fix listed | GO-2026-6318 |
| Go | github.com/lxc/incus | no fix listed | GHSA-64f3-v33m-w89f |
| Go | github.com/lxc/incus/v6 | no fix listed | GO-2026-6318 |
| Go | github.com/lxc/incus/v6 | no fix listed | GHSA-64f3-v33m-w89f |
| Go | github.com/lxc/incus/v7 | 7.2.0 | GO-2026-6318 |
| Go | github.com/lxc/incus/v7 | 7.2.0 | GHSA-64f3-v33m-w89f |
| Ubuntu:25.10 | incus | no fix listed | UBUNTU-CVE-2026-55621 |
| Ubuntu:26.10 | incus | no fix listed | UBUNTU-CVE-2026-55621 |
Affected products (as reported)
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
References
- https://github.com/lxc/incus/security/advisories/GHSA-64f3-v33m-w89f x_refsource_CONFIRM
- https://github.com/canonical/lxd/security/advisories/GHSA-7mr3-28h5-m5vx x_refsource_MISC
- https://github.com/lxc/incus/commit/2e01078366e2653712719dec82318e51c6d21b28 x_refsource_MISC
- https://github.com/lxc/incus/releases/tag/v7.2.0 x_refsource_MISC