{"id":"CVE-2026-55622","summary":"Incus has a project restriction bypass in instance copy across projects","details":"Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new project. This issue could allow an attacker to access secrets in instances they are not authorized to access. Version 7.2.0 patches the issue.","aliases":["GHSA-c9f5-j9c3-mhrg","GO-2026-6319"],"modified":"2026-11-07T02:34:06.503178018Z","published":"2026-08-21T14:40:35.432Z","related":["GHSA-c9f5-j9c3-mhrg","GHSA-qx75-2p3r-pwm5","SUSE-SU-2026:23692-1","SUSE-SU-2026:23712-1","openSUSE-SU-2026:11651-1","openSUSE-SU-2026:21812-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55622.json","unresolved_ranges":[{"extracted_events":[{"range":[{"introduced":"\u003e= 5.1.0, 5.21.5"},{"last_affected":"\u003e= 5.1.0, 5.21.5"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"}]}],"cna_assigner":"GitHub_M","cwe_ids":["CWE-284"]},"references":[{"type":"WEB","url":"https://discuss.linuxcontainers.org/t/incus-7-2-has-been-released/26879"},{"type":"WEB","url":"https://github.com/lxc/incus/releases/tag/v7.2.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55622.json"},{"type":"ADVISORY","url":"https://github.com/canonical/lxd/security/advisories/GHSA-qx75-2p3r-pwm5"},{"type":"ADVISORY","url":"https://github.com/lxc/incus/security/advisories/GHSA-c9f5-j9c3-mhrg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55622"},{"type":"FIX","url":"https://github.com/lxc/incus/commit/1e3ffc53a10950e55de62ac1e0d612be597b84eb"},{"type":"FIX","url":"https://github.com/lxc/incus/pull/3542"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/canonical/lxd","events":[{"introduced":"0"},{"fixed":"7b1f0b6acefa288398ead8dda48b046d7b2795a3"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"4.12.0"},{"fixed":"5.0.7"}]}]}},{"type":"GIT","repo":"https://github.com/lxc/incus","events":[{"introduced":"0"},{"fixed":"c67888b630ed674dd7b0a77f108521ff1b4c494d"},{"introduced":"714bcc5e42b189f54025b8567df1f3408a1cae2c"},{"fixed":"a3e83b529bc597b8be1cdb45ffdbdefe8574e0af"},{"fixed":"1e3ffc53a10950e55de62ac1e0d612be597b84eb"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"0"},{"fixed":"7.2.0"}]},{"range":[{"introduced":"6.0.0"},{"fixed":"6.8.0"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"1e3ffc53a10950e55de62ac1e0d612be597b84eb"}]},{"original_tag":"v7.2.0","range":[{"fixed":"c67888b630ed674dd7b0a77f108521ff1b4c494d"}],"source":"REFERENCES_TAG"}]}}],"versions":["lxd-5.0.2","lxd-5.0.1","lxd-5.0.0","lxd-4.24","lxd-4.23","lxd-4.22","lxd-4.21","lxd-4.20","lxd-4.19","lxd-4.18","lxd-4.17","lxd-4.16","lxd-4.15","lxd-4.14","lxd-4.13","lxd-4.12","lxd-4.11","lxd-4.10","lxd-4.9","lxd-4.8","lxd-4.7","lxd-4.6","lxd-4.5","lxd-4.4","lxd-4.3","lxd-4.2","lxd-4.1","lxd-4.0.0","lxd-3.23","lxd-3.22","lxd-3.21","lxd-3.20","lxd-3.19","lxd-3.18","lxd-3.17","lxd-3.16","lxd-3.15","lxd-3.14","lxd-3.13","lxd-3.12","lxd-3.11","lxd-3.10","lxd-3.9","lxd-3.8","lxd-3.7","lxd-3.6","lxd-3.5","lxd-3.4","lxd-3.3","lxd-3.2","lxd-3.1","lxd-3.0.0","lxd-3.0.0.beta7","lxd-3.0.0.beta6","lxd-3.0.0.beta5","lxd-3.0.0.beta4","lxd-3.0.0.beta3","lxd-3.0.0.beta2","lxd-3.0.0.beta1","lxd-2.21","lxd-2.20","lxd-2.19","lxd-2.18","lxd-2.17","lxd-2.16","lxd-2.15","lxd-2.14","lxd-2.13","lxd-2.12","lxd-2.11","lxd-2.10.1","lxd-2.10","lxd-2.9.3","lxd-2.9.2","lxd-2.9.1","lxd-2.9","lxd-2.8","lxd-2.7","lxd-2.6.2","lxd-2.6.1","lxd-2.6","lxd-2.5","lxd-2.4.1","lxd-2.4","lxd-2.3","lxd-2.2","lxd-2.1","lxd-2.0.0","lxd-2.0.0.rc9","lxd-2.0.0.rc8","lxd-2.0.0.rc7","lxd-2.0.0.rc6","lxd-2.0.0.rc5","lxd-2.0.0.rc4","lxd-2.0.0.rc3","lxd-2.0.0.rc2","lxd-2.0.0.rc1","lxd-2.0.0.beta4","lxd-2.0.0.beta3","lxd-2.0.0.beta2","lxd-2.0.0.beta1","lxd-0.27","lxd-0.26","lxd-0.25","lxd-0.24","lxd-0.23","lxd-0.22","lxd-0.21","lxd-0.20","lxd-0.19","lxd-0.18","lxd-0.17","lxd-0.16","lxd-0.15","lxd-0.14","lxd-0.13","lxd-0.12","lxd-0.11","lxd-0.10","lxd-0.9","lxd-0.8.1","lxd-0.8","lxd-0.7","lxd-0.6","lxd-0.5","lxd-0.4","lxd-0.3","lxd-0.2","lxd-0.1","v6.7.0","v6.6.0","v6.5.0","v6.4.0","v6.3.0","v6.2.0","v6.0.0","v6.1.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-55622.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"}]}