Description

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to access secrets in custom volumes they are not authorized to access. Version 7.2.0 patches the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-21T15:16:41.863Z",
  "pubdate": "2026-08-21T15:16:41.863Z",
  "executiveSummary": "An authorization bypass vulnerability exists in Incus prior to version 7.2.0, specifically affecting custom volume copying operations. The root cause lies in missing authorization validation checks when initiating a copy of a custom volume from a source project to a destination project. This flaw allows an authenticated attacker who lacks explicit permissions to access a target project to successfully clone a custom volume, provided they possess prior knowledge of the target project name and the specific custom volume name.\nThe primary impact of this security deficiency is unauthorized data exposure. Since custom volumes frequently store sensitive application data, database files, and system credentials, successful exploitation grants the attacker read access to confidential secrets contained within volumes they are legally barred from accessing.\nThe vulnerability affects Incus versions prior to 7.2.0. Exploitation requires the attacker to possess authenticated access to the management interface or API along with specific knowledge of target identifiers, specifically the unauthorized project name and custom volume name. Remediation requires upgrading the Incus installation to version 7.2.0 or later, where proper access control and authorization checks have been implemented for custom volume copy routines.",
  "technicalDetails": "The vulnerability is rooted in inadequate access control enforcement within the Incus custom volume management subsystem, specifically during inter-project volume copying operations. In the vulnerable component prior to version 7.2.0, the backend logic processes requests to duplicate or copy custom volumes across project boundaries without sufficiently validating whether the requesting security context possesses the requisite permissions to read or access the source project and its residing storage assets.\nThe attack flow proceeds as follows: First, an unauthorized attacker identifies or guesses the name of a restricted project and the identifier of a target custom volume residing within that restricted project, assuming the attacker has general access to the Incus instance via lower-privileged credentials or another authorized project. Second, the attacker formulates an API request or command-line instruction to copy the target custom volume into a new project under their administrative control. Third, because the API endpoint fails to execute proper authorization checks against the source project context, the Incus daemon processes the copy instruction and duplicates the storage volume. Finally, the attacker mounts or inspects the newly copied custom volume within their own project, yielding direct access to confidential data, cryptographic keys, configuration files, or database secrets previously quarantined within the unauthorized project.\nThe affected component is the volume replication and copying handler within Incus. Affected versions include all releases prior to version 7.2.0. The vulnerability relies on missing privilege validation checks rather than memory corruption or cryptographic flaws. Authentication is required to interact with the Incus API, but the privilege level required on the source project is bypassed entirely due to the absence of access control list validation during the copy execution flow."
}