CVE-2026-55621: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-55621 is a project restriction bypass vulnerability in Incus (a system container and virtual machine manager) that allows an authenticated attacker to copy custom storage volumes across projects without proper authorization. The vulnerability affects Incus versions prior to v7.2.0 and is also present in the related LXD project (stable-5.0 branch). It was published on June 25, 2026, and fixed in Debian 13 (trixie) by upgrading to version 6.0.4-2+deb13u8. It carries a CVSS v3.1 score of 7.7 (High) (GitHub Advisory).

The root cause is missing authorization checks (CWE-284: Improper Access Control) in the storage volume creation handler. When a copy operation is requested, the handler authorizes creation in the target project but fails to verify that the caller has view permission on the source project or source volume. Specifically, req.Source.Project — an attacker-controlled field — is resolved to a storage volume project name and passed directly to CreateCustomVolumeFromCopy without any allowPermission or entitlement check (e.g., CanView on the source volume). The attack vector is network-based, requires low privileges (a valid certificate/user on the server), and no user interaction. A public proof-of-concept Python script was included in the security advisory (GitHub Advisory, LXD PR #18603).

Successful exploitation allows an authenticated but restricted attacker to copy custom storage volumes from projects they are not authorized to access into a project they do control. This results in unauthorized information disclosure, potentially exposing secrets, credentials, or sensitive data stored in custom volumes. Once copied, the attacker can move the volume to another server, further extending the data exposure beyond the original environment (GitHub Advisory).

A public proof-of-concept Python script is included directly in the GitHub Security Advisory, making exploitation straightforward for any attacker with a valid (but restricted) certificate on the target Incus/LXD server. The CVE status is currently "Reserved" with limited formal publication, but the advisory and PoC were published on June 25–26, 2026. No evidence of in-the-wild exploitation or threat actor attribution has been reported at this time, and the vulnerability is not currently listed in the CISA KEV catalog. Nessus detection plugins (IDs 323053, 323350, 323596) have been released (GitHub Advisory, Tenable).

1. Reconnaissance: Identify a remotely accessible Incus or LXD server running a vulnerable version (Incus < v7.2.0 or LXD stable-5.0 before the June 29, 2026 patch). Obtain a valid client certificate with access to at least one project (e.g., default), but restricted from the target project (e.g., secrets).
2. Identify target volume: Determine the name of the source project (e.g., secrets) and the custom volume within it (e.g., secret-vol) through enumeration or insider knowledge.
3. Craft malicious copy request: Use the provided PoC script or a direct API call to POST to /1.0/storage-pools/{pool}/volumes/custom?project={target-project} with a JSON body specifying source.type=copy, source.project=secrets, and source.name=secret-vol.
4. Execute the copy: Run the PoC: python3 poc.py --url https://IP-REMOTE:8443 --cert client.crt --key client.key --target-project default --source-project secrets --source-volume secret-vol --name copy-secret-vol --pool default --source-pool default --insecure. The server processes the request, bypassing source project authorization.
5. Access exfiltrated data: After the copy completes, list volumes in the accessible project (incus storage volume ls remote:default) and mount or inspect the copied volume to extract sensitive data. Optionally, migrate the volume to another server to further obscure the exfiltration (GitHub Advisory).

• Network: Unexpected POST requests to /1.0/storage-pools/{pool}/volumes/custom with a project query parameter pointing to a project the requesting certificate should not have access to; API calls originating from restricted client certificates targeting cross-project copy operations.
• Logs: Incus/LXD daemon logs showing storage volume copy operations where the source project differs from the project associated with the authenticated certificate; entries for CreateCustomVolumeFromCopy initiated by a restricted user.
• File System: Unexpected custom storage volumes appearing in projects accessible to restricted users, particularly volumes with names matching those in restricted/sensitive projects.
• Process: Unusual volume migration operations shortly after a cross-project copy, potentially indicating an attacker moving exfiltrated data off the server (GitHub Advisory).

Upgrade Incus to version v7.2.0 or later, which enforces view permission checks on the source project before allowing custom volume copy operations. For Debian 13 (trixie) users, upgrade the incus package to version 6.0.4-2+deb13u8 or later. For LXD stable-5.0 deployments, apply the fix merged on June 29, 2026 (PR #18603). As a temporary workaround, restrict network access to the Incus/LXD API and audit existing restricted certificates to ensure they cannot reach sensitive projects (GitHub Advisory, LXD PR #18603, Incus 7.2 Announcement).

The vulnerability was reported by security researcher antifob and remediated by Incus maintainer stgraber, who published the advisory and released Incus v7.2.0 on June 29, 2026. The Linux Compatible community noted the Debian package updates addressing this and related vulnerabilities. Tenable released multiple Nessus detection plugins (323053, 323350, 323596) shortly after disclosure, indicating prompt uptake by the vulnerability management community (Incus 7.2 Announcement, Linux Compatible).