https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T17:31:14.129082+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-14999 bdu:2026-14999 2026-10-04T17:31:14.209728+00:00 bdu:2026-14999 https://cve.radiocsirt.org/vuln/euvd-2026-357416 EUVD-2026-357416 2026-10-04T17:31:14.209766+00:00 EUVD-2026-357416 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55621 fkie_cve-2026-55621 2026-10-04T17:31:14.209781+00:00

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to access secrets in custom volumes they are not authorized to access. Version 7.2.0 patches the issue.

 https://cve.radiocsirt.org/vuln/ghsa-64f3-v33m-w89f GHSA-64f3-v33m-w89f — Incus has a project restriction bypass for custom volume copy across projects 2026-10-04T17:31:14.209814+00:00

Affected: Go: github.com/lxc/incus/v7, Go: github.com/lxc/incus/v6, Go: github.com/lxc/incus

### Summary

Missing authorization checks exist for custom volume copying where an attacker who knows the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to access secrets in custom volumes they are not authorized to access.

### Details

The storage volume creation handler authorizes creation in the target project, then passes `req.Source.Project` into the custom-volume copy path without checking that the caller can view the source volume. `req.Source.Project` is the attacker-controlled field. It is resolved to a storage volume project name and passed directly to `CreateCustomVolumeFromCopy`. No `allowPermission` or entitlement check (e.g. `CanView` on the source volume) is performed.

The copy must occur on the same server. However, once the copy has been done, nothing prevents a malicious actor from moving the volume to another server.

### PoC #### Setup

Assume the target server is remotely accessible and a user/certificate has been added.

``` # create a new project and instance incus project create secrets incus profile show default | incus --project secrets edit default incus --project secrets storage volume create default secret-vol

# restrict an existing certificate to prevent access to the project incus config trust edit cert-fp #> set, for example restricted: true projects: - default

# verification, with the restricted certificate i…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11651-1 openSUSE-SU-2026:11651-1 — incus-7.4-1.1 on GA media 2026-10-04T17:31:14.209873+00:00

incus-7.4-1.1 on GA media

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-55621 UBUNTU-CVE-2026-55621 2026-10-04T17:31:14.209899+00:00

Affected: Ubuntu:Pro:16.04:LTS: lxd, Ubuntu:Pro:18.04:LTS: lxd, Ubuntu:20.04:LTS: lxd, Ubuntu:Pro:24.04:LTS: incus, Ubuntu:25.10: incus, Ubuntu:Pro:26.04:LTS: incus

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to access secrets in custom volumes they are not authorized to access. Version 7.2.0 patches the issue.