# Incus has a project restriction bypass in instance copy across projects

Incus copy API authorized only the target project, letting a restricted cert copy an instance from an unreadable project and exfiltrate its secrets.

- Payout: Research
- Severity: high
- Program: Incus
- Found by: antifob
- Disclosed: 2026-08-28
- CVE: CVE-2026-55622
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-c9f5-j9c3-mhrg
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-c9f5-j9c3-mhrg
- Tags: area:cloud domain:infra impact:data-leak impact:internal-access kind:research platform:ghsa sev:high technique:source-review vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** Incus daemon REST API (POST /1.0/instances copy path)
**Root cause:** POST /1.0/instances is authorized against the target project only; the copy path in instances_post.go loads the source instance from req.Source.Project without verifying the caller can view that source instance.
**Steps:**
1. Create project `secrets` with an instance `secret` containing sensitive data.
2. Restrict a client certificate to project `default` only (`restricted: true`, projects: [default]).
3. Send `POST /1.0/instances?project=default` with body `{"name":"copy-secret","source":{"type":"copy","source":"secret","project":"secrets","instance_only":false},"start":false}` using the restricted cert.
4. Copy succeeds despite no access to `secrets`; `incus ls remote:` shows the copied instance in `default`.
5. Optionally move the copied instance to another server to exfiltrate.
**How found:** Code review of the authorization split: instances.go checks the target project for POST /1.0/instances, while instances_post.go trusts req.Source.Project for the copy source without a matching permission check.
**Exploitation:** Attacker with a restricted certificate guesses the source project and instance names, then issues a same-server copy request naming the forbidden source project; the daemon clones the instance into an accessible project, exposing its contents/secrets, and the clone can be moved off-server.
**Escalation:** Post-copy migration of the cloned instance to an attacker-controlled server turns read-restriction bypass into full data exfiltration.
**Insight:** When an API authorizes a request against one resource (target project) but the body references a second resource (source project), check whether the second reference is independently authorized; copy/clone/move endpoints are prime spots for this split-check gap.