Visitar URL original
x/vulndb: potential Go vuln in github.com/lxc/incus/v7/cmd/incusd: GHSA-c9f5-j9c3-mhrg · Issue #6319 · golang/vulndb · GitHub
Skip to content

x/vulndb: potential Go vuln in github.com/lxc/incus/v7/cmd/incusd: GHSA-c9f5-j9c3-mhrg #6319

New issue
New issue
Closed
Closed
x/vulndb: potential Go vuln in github.com/lxc/incus/v7/cmd/incusd: GHSA-c9f5-j9c3-mhrg#6319
Labels
triaged

Description

@GoVulnBot
GoVulnBot
opened on Aug 28, 2026

Advisory GHSA-c9f5-j9c3-mhrg references a vulnerability in the following Go modules:

Module
github.com/lxc/incus
github.com/lxc/incus/v4
github.com/lxc/incus/v6
github.com/lxc/incus/v7

Description:

Summary

Missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new project. This issue could allow an attacker to access secrets in instances they are not authorized to access.

Details

cmd/incusd/instances.go authorizes POST /1.0/instances against the target project. In the copy path, cmd/incusd/instances_post.go then loads the source instance from req.Source.Project without checking whether the caller can view that source insta...

References:

Cross references:

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/lxc/incus
      vulnerable_at: 0.7.0
    - module: github.com/lxc/incus/v4
    - module: github.com/lxc/incus/v6
      vulnerable_at: 6.23.0
    - module: github.com/lxc/incus/v7
      versions:
        - fixed: 7.2.0
      vulnerable_at: 7.1.0
summary: Incus has a project restriction bypass in instance copy across projects in github.com/lxc/incus
cves:
    - CVE-2026-55622
ghsas:
    - GHSA-c9f5-j9c3-mhrg
references:
    - advisory: https://github.com/advisories/GHSA-c9f5-j9c3-mhrg
    - advisory: https://github.com/lxc/incus/security/advisories/GHSA-c9f5-j9c3-mhrg
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-55622
    - fix: https://github.com/lxc/incus/commit/1e3ffc53a10950e55de62ac1e0d612be597b84eb
    - fix: https://github.com/lxc/incus/pull/3542
    - web: https://discuss.linuxcontainers.org/t/incus-7-2-has-been-released/26879
    - web: https://github.com/lxc/incus/releases/tag/v7.2.0
notes:
    - fix: 'github.com/lxc/incus/v4: could not add vulnerable_at: no fix, but could not find latest version from proxy: unexpected end of JSON input'
source:
    id: GHSA-c9f5-j9c3-mhrg
    created: 2026-08-28T19:07:48.883309684Z
review_status: UNREVIEWED

Activity

  1. GoVulnBot
    added
    NeedsTriage
    on Aug 28, 2026
  2. jitsu-net
    added
    triaged
    and removed
    NeedsTriage
    on Aug 31, 2026

  3. gopherbot commented on Sep 1, 2026

    @gopherbot
    gopherbot
    on Sep 1, 2026
    Contributor

    Change https://go.dev/cl/825844 mentions this issue: data/reports: add 26 reports

  4. gopherbot
    closed this as completedin a96babdon Sep 2, 2026
  5. Ali-Razmjoo
    added a commit that references this issue on Sep 3, 2026

    data/reports: add 26 reports

    a96babd
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    triaged

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions