CVE-2026-55621
Received Received - Intake

Authorization Bypass in Incus Custom Volume Copy

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to access secrets in custom volumes they are not authorized to access. Version 7.2.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-55621
EUVD
EUVD-2026-63984

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
incus incus to 7.2.0 (exc)
canonical incus to 7.2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55621 is a vulnerability in Incus, a container and virtual machine manager. It allows an attacker to bypass project restrictions and copy custom volumes from one project to another without proper authorization. The system fails to verify access permissions before copying volumes, enabling attackers to access sensitive data in restricted projects.

Detection Guidance

To detect this vulnerability, check if your Incus version is below 7.2.0. Run 'incus version' to verify. If vulnerable, inspect project permissions and volume access logs for unauthorized copy attempts.

Impact Analysis

An attacker could exploit this to access secrets or sensitive data stored in custom volumes they are not authorized to view. This could lead to data breaches, unauthorized access to confidential information, or exposure of credentials. The attack requires knowing the name of a restricted project and volume, and network access.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR and HIPAA. Organizations using affected Incus versions may face legal penalties, reputational damage, and loss of trust due to data breaches.

Mitigation Strategies

Upgrade Incus to version 7.2.0 or later immediately. Review project permissions and restrict access to sensitive volumes. Monitor for unusual volume copy operations between projects.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55621. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart