CVE-2026-55621: Incus Authorization Bypass Vulnerability

CVE-2026-55621 Overview

CVE-2026-55621 is a missing authorization vulnerability in Incus, a system container and virtual machine manager maintained by the LXC project. Versions prior to 7.2.0 fail to enforce authorization checks during custom volume copy operations. An authenticated attacker who knows the name of a target project and the name of a custom volume within it can copy that volume into a project they control. The flaw exposes secrets and sensitive data stored in custom volumes across project boundaries. Incus 7.2.0 patches the issue by enforcing proper authorization on volume copy requests.

Critical Impact
Authenticated users can copy custom volumes from projects they do not have access to, exposing secrets and confidential data stored in those volumes.

Affected Products

Incus system container and virtual machine manager
Incus versions prior to 7.2.0
Multi-project Incus deployments with custom storage volumes

Discovery Timeline

2026-08-21 - CVE-2026-55621 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-55621

Vulnerability Analysis

Incus organizes tenants into projects that isolate instances, networks, and storage volumes. Custom volumes frequently hold configuration files, keys, and application secrets. The Incus API exposes a volume copy operation that accepts source project and volume identifiers.

In versions before 7.2.0, this operation does not verify that the calling identity holds read access to the source project. The server processes the copy request using its own privileges and delivers the volume contents to a destination project the attacker controls. The weakness maps to [CWE-284: Improper Access Control].

Root Cause

The root cause is a missing authorization check on the source side of the custom volume copy handler. Incus validates the caller's rights on the destination project but does not enforce equivalent checks against the source project and volume. Any authenticated user with project-level API access can therefore reference arbitrary source projects by name.

Attack Vector

Exploitation requires network access to the Incus API and valid credentials for at least one project. The attacker must know or guess the target project name and the name of a custom volume within that project. The attacker issues a volume copy API call specifying the victim project as the source and their own project as the destination. Incus completes the copy, granting the attacker full read access to volume contents. See the GitHub Security Advisory GHSA-64f3-v33m-w89f for authoritative technical details.

Detection Methods for CVE-2026-55621

Indicators of Compromise

Volume copy API calls in Incus logs where the source project differs from projects the caller normally accesses
Creation of new custom volumes in tenant projects that mirror the size and name pattern of volumes in unrelated projects
Unexpected POST /1.0/storage-pools/{pool}/volumes/custom requests with a source field referencing foreign projects

Detection Strategies

Audit Incus daemon logs for cross-project volume copy operations and correlate the caller identity with authorized project membership
Compare custom volume inventories across projects to identify duplicated volume content indicative of unauthorized copies
Enable Incus API request logging and alert on volume copy calls where the source and destination projects have no shared owner

Monitoring Recommendations

Forward Incus API and audit logs to a centralized SIEM for correlation with identity and project ownership data
Track volume creation rates per user and per project to surface anomalous bulk copy activity
Review project membership regularly and alert when API tokens issued to a single project interact with resources scoped to other projects

How to Mitigate CVE-2026-55621

Immediate Actions Required

Upgrade all Incus servers to version 7.2.0 or later, which enforces authorization on the source side of volume copy operations
Rotate any credentials, tokens, or keys stored in custom volumes that may have been copied by unauthorized users
Review Incus audit logs since deployment for cross-project volume copy activity and investigate any hits

Patch Information

Incus 7.2.0 contains the fix for CVE-2026-55621. The patch adds authorization enforcement to the custom volume copy path so the caller must hold access rights on the source project. Refer to the Incus security advisory GHSA-64f3-v33m-w89f for release details and upgrade guidance.

Workarounds

Restrict Incus API network exposure to trusted management networks until the upgrade completes
Revoke or scope down client certificates and tokens for users who do not require multi-project access
Avoid storing plaintext secrets in custom volumes; move sensitive material to an external secrets manager where feasible

bash

# Verify installed Incus version and upgrade
incus --version
# Debian/Ubuntu example
sudo apt update && sudo apt install --only-upgrade incus
# Confirm the running daemon reports 7.2.0 or later
incus info | grep -i server_version