{"affected":[{"product":"incus","source":"CNA: GitHub_M","vendor":"lxc","versions":[{"status":"affected","version":"< 7.2.0"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"github.com/lxc/incus/v7/cmd/incusd","product":"github.com/lxc/incus/v7/cmd/incusd","source":"OSV GHSA-c9f5-j9c3-mhrg","vendor":"","versions":[{"events":[{"introduced":"0"},{"fixed":"7.2.0"}],"lessThan":"7.2.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"github.com/lxc/incus","product":"github.com/lxc/incus","source":"OSV GHSA-c9f5-j9c3-mhrg","vendor":"","versions":[{"events":[{"introduced":"0"}],"greaterThanOrEqual":"0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"github.com/lxc/incus/v6","product":"github.com/lxc/incus/v6","source":"OSV GHSA-c9f5-j9c3-mhrg","vendor":"","versions":[{"events":[{"introduced":"0"}],"greaterThanOrEqual":"0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"github.com/lxc/incus/v7","product":"github.com/lxc/incus/v7","source":"OSV GHSA-c9f5-j9c3-mhrg","vendor":"","versions":[{"events":[{"introduced":"0"},{"fixed":"7.2.0"}],"lessThan":"7.2.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-55622","cwes":["CWE-284"],"description":"Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new project. This issue could allow an attacker to access secrets in instances they are not authorized to access. Version 7.2.0 patches the issue.","epss":{"date":"2026-11-05","percentile":0.27676,"score":0.0034},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/lxc/incus/security/advisories/GHSA-c9f5-j9c3-mhrg"}],"kev":null,"metrics":[{"score":7.7,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1793901604054,"publishedAt":1787323235432,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/lxc/incus/security/advisories/GHSA-c9f5-j9c3-mhrg"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/canonical/lxd/security/advisories/GHSA-qx75-2p3r-pwm5"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/lxc/incus/pull/3542"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/lxc/incus/commit/1e3ffc53a10950e55de62ac1e0d612be597b84eb"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://discuss.linuxcontainers.org/t/incus-7-2-has-been-released/26879"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/lxc/incus/releases/tag/v7.2.0"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/lxc/incus/security/advisories/GHSA-c9f5-j9c3-mhrg"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-c9f5-j9c3-mhrg"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-c9f5-j9c3-mhrg"}],"remediation":[{"kind":"fix","source":"OSV GHSA-c9f5-j9c3-mhrg","text":"github.com/lxc/incus/v7/cmd/incusd (Go): OSV reports a fixed version 7.2.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-c9f5-j9c3-mhrg"},{"kind":"fix","source":"OSV GHSA-c9f5-j9c3-mhrg","text":"github.com/lxc/incus/v7 (Go): OSV reports a fixed version 7.2.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-c9f5-j9c3-mhrg"}],"revision":"28d2773d79f437b6fca976f7a9b80e6dbe851cb051f4caa9176a87835d721fd0","sources":[{"modifiedAt":1793900761514,"name":"CNA: GitHub_M","retrievedAt":1793902263236,"url":"https://www.cve.org/CVERecord?id=CVE-2026-55622"},{"modifiedAt":1793901604054,"name":"OSV / GitHub Security Advisories (partial: 1/2 referenced advisories verified)","retrievedAt":1793902263834,"url":"https://osv.dev/vulnerability/GHSA-c9f5-j9c3-mhrg"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793902285469,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55622"}],"ssvc":{"assessedAt":1787326518322,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Incus has a project restriction bypass in instance copy across projects","updatedAt":1793902285469}