Threats Tagged 'cve-2026-55621'

Multiple security issues have been addressed in the incus-7.4-1.1 package on the GA media of openSUSE Tumbleweed. These fixes resolve vulnerabilities identified by various CVEs. The overall severity of these issues is assessed as medium. No specific affected versions are detailed beyond the fixed package version. There is no CVSS score available for these vulnerabilities. No known exploits are reported in the wild for these issues.

CVE-2026-55621 is an improper access control vulnerability in the lxc incus project. It allows an attacker who knows the name of a project and a custom volume within that project, but lacks authorization, to copy that custom volume into another project they control. This occurs because the system does not verify the attacker's permission to view the source volume before copying. The vulnerability could lead to unauthorized access to secrets stored in custom volumes. Exploitation requires access to the same server where the volume resides. A proof-of-concept script demonstrates how to perform the unauthorized copy. The vulnerability affects incus versions prior to 7.2.0 and has a CVSS 3.1 score of 7.7 (high severity).