CVE-2026-55622 in Incus
Summary
by MITRE • 08/21/2026
Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new project. This issue could allow an attacker to access secrets in instances they are not authorized to access. Version 7.2.0 patches the issue.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
Incus serves as a robust system container and virtual machine manager, facilitating the orchestration of isolated computing environments within infrastructure deployments. A critical security flaw was identified in versions prior to 7.2.0 concerning the authorization mechanisms governing instance operations. Specifically, the vulnerability resides in the logic handling instance copying procedures. The core technical deficiency is an improper access control implementation where the system fails to verify whether the authenticated user possesses sufficient privileges for both the source and destination contexts involved in a copy operation. This oversight allows an attacker who has valid authentication credentials but lacks explicit permissions on specific projects to exploit this gap by leveraging knowledge of project names and instance identifiers that are not their own.
The operational impact of this vulnerability is significant, as it enables unauthorized lateral movement within the container management infrastructure. An adversary can take a snapshot or copy of an existing virtual machine or system container from a restricted project into a new project where they do have access rights. By doing so, the attacker effectively bypasses the intended isolation boundaries between projects. This action grants them direct access to the underlying file systems and configurations of instances that were previously protected by strict authorization policies. Consequently, sensitive data stored within these unauthorized instances, such as application secrets, database credentials, or private keys, becomes accessible to the unprivileged user, leading to a severe compromise of confidentiality and integrity across the managed environment.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Assignment, specifically manifesting as an authorization bypass in administrative functions. In terms of tactical mapping within the MITRE ATT&CK framework, this behavior corresponds to techniques associated with lateral movement and data exfiltration from cloud or container environments. The attacker utilizes valid credentials but exploits a flaw in access control logic rather than credential theft, allowing them to pivot into restricted zones without triggering typical anomaly detection systems that focus on authentication failures.
To mitigate this risk, organizations running Incus must upgrade immediately to version 7.2.0 or later, where the authorization checks for instance copying have been rigorously enforced and patched. For environments where an immediate upgrade is not feasible due to operational constraints, administrators should implement strict network segmentation between management interfaces and untrusted networks if applicable. Additionally, enforcing principle of least privilege by auditing user permissions across all projects ensures that no single account has broad access unless absolutely necessary. Regular security audits focusing on container orchestration tools are recommended to detect any potential exploitation attempts or misconfigurations before they lead to data breaches.