# LXD has project restriction bypass for custom volume copy across projects

LXD/Incus custom volume copy trusted attacker-supplied source project, letting a restricted certificate copy volumes from projects it cannot access.

- Payout: Research
- Severity: high
- Program: LXD
- Found by: antifob
- Disclosed: 2026-11-06
- CVE: CVE-2026-55621
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-7mr3-28h5-m5vx
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-7mr3-28h5-m5vx
- Tags: area:cloud domain:infra impact:data-leak impact:internal-access kind:research platform:ghsa sev:high tech:rest technique:source-review vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** LXD/Incus REST API storage volume creation endpoint (/1.0/storage-pools/{pool}/volumes/custom)
**Root cause:** The storage volume creation handler authorizes creation in the target project but passes the attacker-controlled req.Source.Project into CreateCustomVolumeFromCopy without any CanView/entitlement check on the source volume.
**Steps:**
1. Create project `secrets` with a custom volume `secret-vol` on pool `default`.
2. Restrict a certificate to project `default` only (`restricted: true`, projects: [default]).
3. POST to `/1.0/storage-pools/default/volumes/custom?project=default` with body `{"name":"copy-secret-vol","type":"custom","content_type":"filesystem","source":{"type":"copy","name":"secret-vol","project":"secrets","volume_only":false}}` using the restricted cert.
4. Wait for the async copy, then `incus storage volume ls remote:default` shows the copied volume.
**How found:** Code reading of the storage volume creation handler: noticed req.Source.Project flows into CreateCustomVolumeFromCopy with no allowPermission/CanView check on the source volume.
**Exploitation:** A restricted client certificate authorized only for project `default` sends a custom volume create request whose source.project names a forbidden project; the server copies the volume into the allowed project, exposing its contents. The copy must be on the same server, but the volume can then be moved elsewhere.
**Escalation:** After copying into an accessible project, the attacker can move the volume to another server to exfiltrate secrets.
**Insight:** In multi-tenant APIs, the target-project authorization check is not enough: any attacker-controlled source-project field on copy/clone/move operations needs its own entitlement check on the source object.

## Proof of concept (copied exactly from the original report)

**Exploit invocation with source project secrets**

```
python3 poc.py --url https://IP-REMOTE:8443 \
    --cert path/to/client.crt --key path/to/client.key \
    --target-project default --source-project secrets \
    --source-volume secret-vol --name copy-secret-vol \
    --pool default --source-pool default \
    --insecure
```

## Write-ups of the same bug (oldest first)
- 2026-08-28: [Incus has a project restriction bypass for custom volume copy across projects](https://bugbountylibrary.com/r/ghsa%3AGHSA-64f3-v33m-w89f) — antifob
- 2026-11-06: [LXD has project restriction bypass for custom volume copy across projects](https://bugbountylibrary.com/r/ghsa%3AGHSA-7mr3-28h5-m5vx) — antifob (this one)