Advisory · CVE-2026-115376
Incus custom volume copy skips the source access check when the source type is omitted
Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 treats a custom volume create with a source volume but no source type as a copy, without the source access check that applies to explicit copies, so a project-restricted client can copy and read any other project volumes, snapshots and configuration. CVSS 4.0 8.3.
- Vendor
- Linux Containers
- Product
- Incus
- Identifier / CWE
- CVE-2026-115376
CWE-284 - Action timing
- Immediate
Explain it like I’m five
Asking Incus to copy a volume normally triggers a check that you are allowed to see the original. Leaving one field blank takes a side path that does the copy without ever asking that question.
- 01Client sends a crafted create request
A client allowed to create custom volumes in a project posts a volume create request with a chosen source project and source volume, but omits the source type field.
- 02Request takes the unchecked path
Per the Incus advisory, creating a volume with a source but no source type is handled as a copy, while the source volume access check only applies when the type is explicitly set to copy.
- 03Foreign volume is copied
The request goes straight to the copy code path with the caller-controlled source project, with no view check on the source volume.
- 04Contents are read across projects
The client can copy any custom volume from any other project on the server, including its snapshots and configuration, and read its contents, defeating project isolation.
What happened
The Incus project disclosed CVE-2026-115376 in its GitHub security advisory: creating a custom storage volume with a source volume but no source type is handled as a copy, but the source volume access check only applies when the source type is explicitly set to copy. A request that omits the type goes straight to the copy code path with a caller-controlled source project. The CVE record lists Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 as affected, with 7.0.2 and 7.5.0 as the fixed releases. The CVSS 4.0 score is 8.3 and the CVSS 3.1 score is 7.7, with changed scope.
Per the advisory, the custom volume create endpoint only checks the create permission on the target project; the view check on the source volume lives in the explicit copy branch of the source type switch, while the empty type branch calls the same copy helper without it. Any client allowed to create custom volumes in a project can therefore copy any custom volume from any other project on the server, including its snapshots and configuration, and read its contents. Incus notes the official client always sets the source type to copy, so the empty form is only reachable through a crafted request, which makes matching API calls a useful hunting signal.
What to do
- Inventory Incus hosts and clusters and note the version of each daemon.
- Upgrade affected installations to Incus 7.0.2 or 7.5.0 or later for the branch in use, using the Incus project release guidance.
- Until every host is upgraded, restrict custom volume creation to trusted clients in projects that share a server with other tenants.
- Hunt the Incus API logs for custom volume create requests that carry a source project but no source type, and for volumes copied across project boundaries.
- Review volumes that appeared in restricted projects through copies, and verify the deployed version on every host after updating.
Management note
Project isolation is the reason restricted clients exist on shared Incus servers. A blank field quietly removed the source check, so treat cross-project copies in the logs as potential data exposure and patch the shared hosts first.