CVE-2026-55622: CWE-284: Improper Access Control in lxc incus

The vulnerability in lxc incus involves missing authorization checks during instance copying. Specifically, the POST /1.0/instances endpoint authorizes against the target project but does not verify access rights for the source instance specified in req.Source.Project. This allows an attacker with knowledge of a project and instance name, but without access permissions, to copy the instance to another project on the same server. After copying, the attacker could move the instance to another server. The proof-of-concept demonstrates how a restricted certificate can be used to copy an instance from a project the caller should not access. The vulnerability is tracked as CVE-2026-55622 and affects versions before 7.2.0.

An attacker with limited privileges can copy instances from projects they are not authorized to access, potentially exposing sensitive information or secrets contained within those instances. This unauthorized copying can lead to information disclosure. The vulnerability does not require user interaction and can be exploited remotely if the server is accessible and the attacker has a valid user certificate.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the server and carefully manage user certificates and project permissions to limit exposure. Monitor for any updates from the lxc incus project regarding patches or official fixes for this vulnerability.