https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T22:16:45.779347+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-15000 bdu:2026-15000 2026-10-04T22:16:45.784831+00:00 bdu:2026-15000 https://cve.radiocsirt.org/vuln/euvd-2026-357364 EUVD-2026-357364 2026-10-04T22:16:45.784865+00:00 EUVD-2026-357364 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55622 fkie_cve-2026-55622 2026-10-04T22:16:45.784880+00:00

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new project. This issue could allow an attacker to access secrets in instances they are not authorized to access. Version 7.2.0 patches the issue.

 https://cve.radiocsirt.org/vuln/ghsa-c9f5-j9c3-mhrg GHSA-c9f5-j9c3-mhrg — Incus has a project restriction bypass in instance copy across projects 2026-10-04T22:16:45.784911+00:00

Affected: Go: github.com/lxc/incus/v7/cmd/incusd

### Summary Missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new project. This issue could allow an attacker to access secrets in instances they are not authorized to access.

### Details `cmd/incusd/instances.go` authorizes `POST /1.0/instances` against the target project. In the copy path, `cmd/incusd/instances_post.go` then loads the source instance from `req.Source.Project` without checking whether the caller can view that source instance.

The copy must occur on the same server. However, once the copy has been done, nothing prevents a malicious actor from moving the instance to another server.

### PoC

#### Setup

Assumes the target server is remotely accessible and a user/certificate has been added.

``` # create a new project and instance incus project create secrets incus profile show default | incus --project secrets edit default incus --project secrets init images:debian/trixie secret

# restrict an existing certificate to prevent access to the project incus config trust edit cert-fp #> set, for example restricted: true projects: - default

# verification, with the restricted certificate incus ls remote: ```

#### Exploitation

The below script was partly generated. To copy the `secret` instance to the `default` project, the following command can be used.

``` python3 poc.py --url https://IP-REMOTE:8443 \…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11651-1 openSUSE-SU-2026:11651-1 — incus-7.4-1.1 on GA media 2026-10-04T22:16:45.784965+00:00

incus-7.4-1.1 on GA media

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-55622 UBUNTU-CVE-2026-55622 2026-10-04T22:16:45.784990+00:00

Affected: Ubuntu:Pro:16.04:LTS: lxd, Ubuntu:Pro:18.04:LTS: lxd, Ubuntu:20.04:LTS: lxd, Ubuntu:Pro:24.04:LTS: incus, Ubuntu:25.10: incus, Ubuntu:Pro:26.04:LTS: incus

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new project. This issue could allow an attacker to access secrets in instances they are not authorized to access. Version 7.2.0 patches the issue.