CVE-2026-55622 Overview
CVE-2026-55622 is a missing authorization vulnerability in Incus, an open-source system container and virtual machine manager. Versions prior to 7.2.0 fail to enforce access checks during instance copy operations. An authenticated attacker who knows the name of a target project and an instance within it can copy that instance into a project they control. The copy exposes the contents of instances the attacker was never authorized to view, including secrets. The maintainers released version 7.2.0 to correct the authorization logic. The weakness is classified under [CWE-284: Improper Access Control].
Critical Impact
Authenticated Incus users can copy instances from projects they do not have access to, exposing secrets and sensitive workload data across project boundaries.
Affected Products
- Incus system container and virtual machine manager, all versions prior to 7.2.0
- Deployments exposing the Incus API to multiple project tenants
- Multi-tenant environments relying on Incus project isolation for confidentiality
Discovery Timeline
- 2026-08-21 - CVE-2026-55622 published to NVD
- 2026-08-21 - Last updated in NVD database
Technical Details for CVE-2026-55622
Vulnerability Analysis
Incus organizes workloads into projects, which are the primary boundary for tenant isolation. The instance copy code path prior to 7.2.0 does not verify that the caller has authorization on the source project before duplicating an instance. A user with valid Incus credentials and low privileges can invoke the copy operation, referencing a source project and instance they do not own. Incus proceeds with the operation and places a copy under a destination project the attacker controls. Once copied, the attacker inspects the instance filesystem and metadata, revealing credentials, tokens, configuration files, and other secrets stored inside the workload. The confidentiality impact is high because container and VM images often hold API keys, database passwords, and cloud credentials.
Root Cause
The defect is a missing authorization check on the source object of the copy operation. Incus validates that the caller can write to the destination project but does not confirm read access to the source project or instance. This asymmetric check permits cross-project data movement that violates the project isolation model.
Attack Vector
Exploitation requires network access to the Incus API and a valid low-privileged account. The attacker must know or guess the source project name and the instance name. No user interaction is required, and the scope of impact extends beyond the vulnerable component because data crosses tenant boundaries. Technical details are documented in the GitHub Security Advisory GHSA-c9f5-j9c3-mhrg.
Detection Methods for CVE-2026-55622
Indicators of Compromise
- Instance copy API calls where the source and destination project fields reference different projects belonging to different owners.
- Newly created instances in a project whose disk contents match instances in another unrelated project.
- Audit log entries showing successful copy operations initiated by accounts that lack membership in the source project.
Detection Strategies
- Review Incus audit logs for POST /1.0/instances requests using the source.project parameter and correlate with the caller's authorized project list.
- Alert when a single identity performs instance copies across multiple distinct source projects in a short window.
- Baseline normal copy activity per project and flag deviations, especially copies initiated by non-administrator accounts.
Monitoring Recommendations
- Forward Incus daemon logs and API access logs to a centralized SIEM for correlation with identity telemetry.
- Monitor for unexpected growth in storage pools tied to accounts that historically consume little capacity.
- Track project membership changes alongside copy activity to identify probing behavior.
How to Mitigate CVE-2026-55622
Immediate Actions Required
- Upgrade Incus to version 7.2.0 or later on all servers and cluster members.
- Rotate secrets, API tokens, and credentials stored inside instances that may have been accessed through unauthorized copies.
- Audit recent instance copy operations and identify any that crossed project boundaries without authorization.
Patch Information
Incus version 7.2.0 introduces the missing authorization check on the source object of the copy operation. The upstream fix is described in the GitHub Security Advisory GHSA-c9f5-j9c3-mhrg. Administrators should apply the update through their distribution package manager or the official Incus release channel and restart the incusd service.
Workarounds
- Restrict Incus API access to trusted administrators until the upgrade is applied.
- Remove or scope down low-privileged accounts that do not require project-level operations.
- Avoid storing plaintext secrets inside instance filesystems; use external secret managers referenced at runtime.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
