Executive brief
Incus, a container and virtual machine management system, contains a flaw that allows authenticated users to copy storage volumes from projects they are not authorized to access. An attacker with access to one project can copy sensitive data stored in custom volumes belonging to restricted projects, leading to unauthorized information disclosure. The vulnerability requires network access and valid credentials but no user interaction.
Technical details
The vulnerability exists in the storage volume creation handler, which authorizes creation in the target project but fails to validate that the caller has permission to view the source volume before invoking the custom-volume copy path. The attacker-controlled `req.Source.Project` field is passed directly to `CreateCustomVolumeFromCopy` without any authorization checks (e.g., `allowPermission` or `CanView` entitlements). The copy operation must occur on the same server initially, but once created, nothing prevents the attacker from moving the volume elsewhere. The attack is feasible against remotely accessible Incus instances where the attacker has a valid client certificate or credentials restricted to certain projects. Exploitation requires knowing or guessing the target project name and volume name.
Affected products
- LXC Incus v7 < 7.2.0, v6 <= 6.23.0, <= 0.7.0
Timeline
- 2026-06-25: disclosed
- 2026-06-25: patched: Patched in v7.2.0
- 2026-08-28: advisory