CVE-2026-55621

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55621", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-16T23:31:22.446Z", "datePublished": "2026-08-21T14:39:43.775Z", "dateUpdated": "2026-11-05T23:48:43.471Z"}, "containers": {"cna": {"title": "Incus has a project restriction bypass for custom volume copy across projects", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/lxc/incus/security/advisories/GHSA-64f3-v33m-w89f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/lxc/incus/security/advisories/GHSA-64f3-v33m-w89f"}, {"name": "https://github.com/canonical/lxd/security/advisories/GHSA-7mr3-28h5-m5vx", "tags": ["x_refsource_MISC"], "url": "https://github.com/canonical/lxd/security/advisories/GHSA-7mr3-28h5-m5vx"}, {"name": "https://github.com/lxc/incus/commit/2e01078366e2653712719dec82318e51c6d21b28", "tags": ["x_refsource_MISC"], "url": "https://github.com/lxc/incus/commit/2e01078366e2653712719dec82318e51c6d21b28"}, {"name": "https://github.com/lxc/incus/releases/tag/v7.2.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/lxc/incus/releases/tag/v7.2.0"}], "affected": [{"vendor": "lxc", "product": "incus", "versions": [{"version": "< 7.2.0", "status": "affected"}]}, {"vendor": "canonical", "product": "lxd", "versions": [{"version": ">= 4.12.0, < 5.0.7", "status": "affected"}, {"version": ">= 5.1.0, 5.21.5", "status": "affected"}, {"version": ">= 6.0.0, < 6.8.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T23:48:43.471Z"}, "descriptions": [{"lang": "en", "value": "Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to access secrets in custom volumes they are not authorized to access. Version 7.2.0 patches the issue."}], "source": {"advisory": "GHSA-64f3-v33m-w89f", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T16:41:08.846627Z", "id": "CVE-2026-55621", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T16:41:23.236Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-55621", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T16:41:08.846627Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T16:41:18.602Z"}}], "cna": {"title": "Incus has a project restriction bypass for custom volume copy across projects", "source": {"advisory": "GHSA-64f3-v33m-w89f", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "lxc", "product": "incus", "versions": [{"status": "affected", "version": "< 7.2.0"}]}, {"vendor": "canonical", "product": "lxd", "versions": [{"status": "affected", "version": ">= 4.12.0, < 5.0.7"}, {"status": "affected", "version": ">= 5.1.0, 5.21.5"}, {"status": "affected", "version": ">= 6.0.0, < 6.8.0"}]}], "references": [{"url": "https://github.com/lxc/incus/security/advisories/GHSA-64f3-v33m-w89f", "name": "https://github.com/lxc/incus/security/advisories/GHSA-64f3-v33m-w89f", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/canonical/lxd/security/advisories/GHSA-7mr3-28h5-m5vx", "name": "https://github.com/canonical/lxd/security/advisories/GHSA-7mr3-28h5-m5vx", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/lxc/incus/commit/2e01078366e2653712719dec82318e51c6d21b28", "name": "https://github.com/lxc/incus/commit/2e01078366e2653712719dec82318e51c6d21b28", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/lxc/incus/releases/tag/v7.2.0", "name": "https://github.com/lxc/incus/releases/tag/v7.2.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to access secrets in custom volumes they are not authorized to access. Version 7.2.0 patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T23:48:43.471Z"}}}, "cveMetadata": {"cveId": "CVE-2026-55621", "state": "PUBLISHED", "dateUpdated": "2026-11-05T23:48:43.471Z", "dateReserved": "2026-06-16T23:31:22.446Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-21T14:39:43.775Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "incus", "vendor": "lxc", "versions": [{"status": "affected", "version": "< 7.2.0"}]}, {"product": "lxd", "vendor": "canonical", "versions": [{"status": "affected", "version": ">= 4.12.0, < 5.0.7"}, {"status": "affected", "version": ">= 5.1.0, 5.21.5"}, {"status": "affected", "version": ">= 6.0.0, < 6.8.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to access secrets in custom volumes they are not authorized to access. Version 7.2.0 patches the issue."}, {"lang": "es", "value": "Incus es un gestor de contenedores de sistema y m\u00e1quinas virtuales. Antes de la versi\u00f3n 7.2.0, existen comprobaciones de autorizaci\u00f3n faltantes para la copia de vol\u00famenes personalizados, donde un atacante, conociendo el nombre de un proyecto al que no tiene acceso y el nombre de un volumen personalizado en ese proyecto, puede copiar el volumen personalizado a un nuevo proyecto. Este problema podr\u00eda permitir a un atacante acceder a secretos en vol\u00famenes personalizados a los que no est\u00e1 autorizado a acceder. La versi\u00f3n 7.2.0 corrige el problema."}], "id": "CVE-2026-55621", "lastModified": "2026-11-06T01:17:50.043", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55621", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T16:41:08.846627Z", "version": "2.0.3"}}]}, "published": "2026-08-21T15:16:41.863", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/canonical/lxd/security/advisories/GHSA-7mr3-28h5-m5vx"}, {"source": "security-advisories@github.com", "url": "https://github.com/lxc/incus/commit/2e01078366e2653712719dec82318e51c6d21b28"}, {"source": "security-advisories@github.com", "url": "https://github.com/lxc/incus/releases/tag/v7.2.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/lxc/incus/security/advisories/GHSA-64f3-v33m-w89f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "incus", "source": "cna", "vendor": "lxc"}, "product": "incus", "vendor": "lxc"}], "created": "2026-08-21T16:30:06.977968+00:00", "updated": "2026-08-21T17:00:03.837191+00:00", "vendors": ["lxc", "lxc$PRODUCT$incus"]}