CVE-2026-55621

high

Assigned by CNA: github_m

Published 2026-08-21 · Modified 2026-08-21

Discuss on Community Propose mitigation

CVSS v3

7.7

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CVSS v4 NEW

—

not yet in upstream

VIR risk

7.7

Description

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to access secrets in custom volumes they are not authorized to access. Version 7.2.0 patches the issue.

Predictions

Exploit likelihood

85%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Debian Security Tracker · View original ↗ · DFSG

CVE-2026-55621 NameCVE-2026-55621 SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) Vulnerable and fixed packages The table below lists information on source packages. Source PackageReleaseVersionStatus incus (PTS)trixie (security), trixie6.0.4-2+deb13u7vulnerable forky7.0.0-3vulnerable…

CVE-2026-55621

Name	CVE-2026-55621
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
incus (PTS)	trixie (security), trixie	6.0.4-2+deb13u7	vulnerable
	forky	7.0.0-3	vulnerable
	sid	7.0.0-5	fixed
lxd (PTS)	bookworm, bookworm (security)	5.0.2-5+deb12u6	vulnerable
	trixie (security), trixie	5.0.2+git20231211.1364ae4-9+deb13u6	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
incus	source	(unstable)	7.0.0-5
lxd	source	(unstable)	(unfixed)

Notes

https://github.com/lxc/incus/security/advisories/GHSA-64f3-v33m-w89f
https://github.com/lxc/incus/commit/2e01078366e2653712719dec82318e51c6d21b28 (v7.2.0)

Home - Debian Security - Source (Git)

Apply commands

text fix

Notes

https://github.com/lxc/incus/security/advisories/GHSA-64f3-v33m-w89fhttps://github.com/lxc/incus/commit/2e01078366e2653712719dec82318e51c6d21b28 (v7.2.0)

OS impact

Debian Mixed 4 releases

Version	Status	Fixed in
trixie	Fixed	`6.0.4-2+deb13u8`
sid	Fixed	`7.0.0-5`
forky	Fixed	`7.0.0-5`
bookworm	Affected	—

References

CWEs

CWE-284

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.