CVE-2026-81501: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-81501 is an improper access control vulnerability in Incus (the container and VM manager) that allows a project-restricted TLS client to import a private image from another project without authorization. It affects Incus versions prior to v7.4.0, including the Ubuntu 24.04 packaged version (Incus 6.0.0). The vulnerability was published on August 27, 2026, and patched in v7.4.0. It carries a CVSS v3.1 score of 6.3 (Medium), though an alternative vector without fingerprint-knowledge as a complexity factor yields 7.7 (High) (GitHub Advisory).

The root cause is CWE-284 (Improper Access Control) in the imageDownload function within cmd/incusd/daemon_images.go. When a requested image is not found in the destination project, imageDownload calls tx.GetImageFromAnyProject(ctx, fp) to locate a matching local image by fingerprint, then clones it into the caller's project via CreateImage — without checking whether the image is public (imgInfo.Public) or whether the caller has CanView entitlement on the source image object. By contrast, imageGet, imagesGet, and imageExport all enforce CheckPermission(ObjectImage, CanView) and return 404 for private images. The vulnerability is reachable via POST /1.0/images with source.type=image or POST /1.0/instances when source.server != "". The attacker must know the 64-hex image fingerprint in advance (obtained out-of-band), and must hold CanCreateImages rights in their own project (GitHub Advisory).

A restricted TLS client with image-create rights in their own project can copy a private image's full properties and global rootfs blob from another project into their own, then view, export, or launch instances from it. This breaks Incus project isolation for private images, resulting in a high confidentiality impact (full image data exposure) with no integrity or availability impact on the victim image. The scope change is notable: a client confined to one project can access resources belonging to a separate security scope (GitHub Advisory).

A proof-of-concept (incus-private-image-anyproject.zip) was included with the advisory disclosure, demonstrating runtime reproduction in an isolated Docker environment running Ubuntu 24.04 with Incus 6.0.0. The exploit requires a low-privilege authenticated attacker (project-restricted TLS client) and prior knowledge of the target image's 64-hex fingerprint, which is not enumerable via standard API calls (raising attack complexity). No in-the-wild exploitation has been reported, and the CVE is not listed in the CISA KEV catalog. The vulnerability was detected by Nessus plugin 341156 (GitHub Advisory, Tenable).

1. Obtain a restricted TLS client credential: Acquire or register a TLS certificate bound to a specific project (e.g., hunt-b) with CanCreateImages rights but without cross-project CanView access.
2. Obtain the target image fingerprint out-of-band: Retrieve the 64-hex SHA-256 fingerprint of the private image in the victim project (e.g., default) through logs, backups, former project membership, or a predictable custom image name.
3. Verify access is blocked via normal API: Confirm that GET /1.0/images/{fingerprint}?project=default returns 404, establishing that direct access is denied.
4. Trigger the vulnerable imageDownload path: Send a POST /1.0/images?project=hunt-b request with source.type=image and the known fingerprint, pointing source.server to an attacker-controlled HTTPS server that returns a successful operation response without supplying actual image bytes.
5. Incus clones the private image: The imageDownload function calls GetImageFromAnyProject with the fingerprint, finds the private image in default, and clones its properties and blob (from var/images/) into hunt-b without a CanView check.
6. Access the cloned image: The private image (including properties such as custom markers and the rootfs blob) is now listed and accessible within hunt-b, allowing the attacker to export or launch instances from it (GitHub Advisory).

• Network: Unexpected POST /1.0/images?project=<attacker-project> API requests with source.type=image originating from a restricted TLS client certificate; outbound connections from the Incus daemon to an unknown external HTTPS server during image import.
• Logs: Incus daemon logs showing GetImageFromAnyProject resolving a fingerprint to a project other than the requesting client's project, followed by CreateImage into the attacker's project; audit entries for image creation in a project by a client not previously associated with the source image.
• File System: Unexpected duplication of image blob files under var/images/ corresponding to private images from other projects; new image metadata records in the Incus database referencing a fingerprint that exists in a different project.
• Process/API: Presence of private image properties (e.g., custom properties.description markers) appearing in an unauthorized project's image list via GET /1.0/images?project=<attacker-project> (GitHub Advisory).

Upgrade Incus to v7.4.0 or later, which introduces a CanView check after GetImageFromAnyProject succeeds, ensuring private images from other projects are not reused unless the caller has explicit permission or the image is public. For Debian-based systems, note that the Feedly advisory indicates the vendor provides no patch for the affected packaged version (Incus 6.0.0 on Ubuntu 24.04), so upgrading to upstream v7.4.0 is the recommended path. As a workaround, restrict CanCreateImages rights to fully trusted clients only, and avoid sharing image fingerprints across project boundaries (GitHub Advisory, openSUSE Advisory).

The vulnerability was reported by researcher Yuliang Xiao (unravel11) and remediated by Incus maintainer stgraber. The Incus 7.2.2 release announcement and the Incus 7.4 feature announcement were noted in the community around the same period. openSUSE issued a security announcement referencing the advisory. No significant broader media coverage or social media discussion has been identified beyond these vendor and community channels (stgraber blog, openSUSE Advisory, Linuxiac).