CVE catalog

CVE-2026-55621

lxd affected and fixed versions

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to access secrets in custom volumes they are not authorized to access. Version 7.2.0 patches the issue.

Severity: High · CVSS 7.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Published: Aug 21, 2026, 2:39:43 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.34% · Oct 27, 2026

Projects and upstream resources

[lxd][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Version impact has not been established. The original provider fields are retained below.

Provider details and historical evidence

Original provider fields

{
  "package_releases": [
    {
      "name": "lxd",
      "status": "fixed",
      "release": "trixie",
      "version": "5.0.2+git20231211.1364ae4-9+deb13u7"
    },
    {
      "name": "lxd",
      "status": "fixed",
      "release": "trixie-security",
      "version": "5.0.2+git20231211.1364ae4-9+deb13u7"
    },
    {
      "name": "lxd",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "5.0.2-5+deb12u6"
    },
    {
      "name": "lxd",
      "status": "vulnerable",
      "release": "bookworm-security",
      "version": "5.0.2-5+deb12u6"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "lxd",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "5.0.2+git20231211.1364ae4-9+deb13u7"
    },
    {
      "bug": null,
      "name": "lxd",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "end-of-life",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "github.com/lxc/incus/v7",
      "ecosystem": "go",
      "fixed_version": "7.2.0",
      "provider_record_id": "GHSA-64F3-V33M-W89F"
    },
    {
      "name": "github.com/lxc/incus/v6",
      "ecosystem": "go",
      "fixed_version": "",
      "provider_record_id": "GHSA-64F3-V33M-W89F"
    },
    {
      "name": "github.com/lxc/incus",
      "ecosystem": "go",
      "fixed_version": "",
      "provider_record_id": "GHSA-64F3-V33M-W89F"
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[lxd]Unknown
Details (4)
- 5.0.2-5+deb12u6 · amd64 · bookworm
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · arm64 · bookworm
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · amd64 · bookworm-security
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · arm64 · bookworm-security
  Affected
  dsa · lxd · debian · bookworm
[lxd-agent]Unknown
Source package: [lxd]
Details (4)
- 5.0.2-5+deb12u6 · amd64 · bookworm
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · arm64 · bookworm
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · amd64 · bookworm-security
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · arm64 · bookworm-security
  Affected
  dsa · lxd · debian · bookworm
[lxd-client]Unknown
Source package: [lxd]
Details (4)
- 5.0.2-5+deb12u6 · amd64 · bookworm
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · arm64 · bookworm
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · amd64 · bookworm-security
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · arm64 · bookworm-security
  Affected
  dsa · lxd · debian · bookworm
[lxd-migrate]Unknown
Source package: [lxd]
Details (4)
- 5.0.2-5+deb12u6 · amd64 · bookworm
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · arm64 · bookworm
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · amd64 · bookworm-security
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · arm64 · bookworm-security
  Affected
  dsa · lxd · debian · bookworm
[lxd-tools]Unknown
Source package: [lxd]
Details (4)
- 5.0.2-5+deb12u6 · amd64 · bookworm
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · arm64 · bookworm
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · amd64 · bookworm-security
  Affected
  dsa · lxd · debian · bookworm
- 5.0.2-5+deb12u6 · arm64 · bookworm-security
  Affected
  dsa · lxd · debian · bookworm

Observed: Oct 27, 2026, 7:04:17 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]