Incus: Authorization bypass in custom volume copy allows cross-project access
Summary
Incus, a system container and virtual machine manager, contains an authorization bypass when a custom storage volume is created with a source volume but without source.type. A project-restricted client with permission to create custom volumes can send a crafted POST request with a chosen source.project to copy volumes, snapshots and configuration from other projects and read their contents. The official client always sets the type, so exploitation requires a hand-crafted API request by an authenticated user.
Affected
- Incus 7.0.1 before 7.0.2
- Incus 7.2.0 before 7.5.0
- The GitHub advisory lists all versions below 7.5.0; the lower bound is unconfirmed.
- Incus 6.0 LTS: not clearly stated; treat as a precaution.
Fixed in
- Incus 7.0.2 (7.0 LTS line)
- Incus 7.5.0 (7.x line)
Workaround
- No vendor workaround is documented.
- Interim measure (own assessment, not from a vendor source): limit who can create custom storage volumes in restricted projects and restrict Incus API access to trusted clients until patched.
Exploitation
- Not listed in the CISA KEV catalogue.
- No reports of exploitation in the wild found.
- No public proof-of-concept found.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
Our recommendation
- Update Incus to 7.0.2 or 7.5.0 (or a fixed distribution package).
- If you run Incus 6.0, update to 6.0.7 as a precaution.
- Check whether the Incus API is reachable from untrusted networks or users.
- Review which users can create custom volumes in restricted projects and remove unnecessary rights.
- If several teams or customers share one Incus server, prioritise patching.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GHSA advisory GHSA-jh4v-j34r-2mgh github.com
- VulnCheck advisory www.vulncheck.com
- Ubuntu CVE page ubuntu.com
- Incus 6.0.7 release discuss.linuxcontainers.org
- Incus 7.0.2 release discuss.linuxcontainers.org
- Incus 7.5 release discuss.linuxcontainers.org
- Fix pull request #4071 github.com
- Debian BSA-139 backports.debian.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:22.
Original description (NVD)
Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type. Attackers can send crafted POST requests to the custom volumes endpoint with a chosen source.project to copy and read other projects' volumes, snapshots, and configuration.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.