CVE-2026-55622: Incus has a project restriction bypass in instance copy across projects
(updated )
Missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don’t have access to and the name of an instance in that project can copy the instance to a new project. This issue could allow an attacker to access secrets in instances they are not authorized to access.
References
- discuss.linuxcontainers.org/t/incus-7-2-has-been-released/26879
- github.com/advisories/GHSA-c9f5-j9c3-mhrg
- github.com/canonical/lxd/security/advisories/GHSA-qx75-2p3r-pwm5
- github.com/lxc/incus/commit/1e3ffc53a10950e55de62ac1e0d612be597b84eb
- github.com/lxc/incus/pull/3542
- github.com/lxc/incus/releases/tag/v7.2.0
- github.com/lxc/incus/security/advisories/GHSA-c9f5-j9c3-mhrg
- nvd.nist.gov/vuln/detail/CVE-2026-55622
Code Behaviors & Features
Detect and mitigate CVE-2026-55622 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →