- Severity: HIGH
- Ecosystems: go
- Packages: github.com/canonical/lxd
Reported from https://github.com/lxc/incus/security/advisories/GHSA-64f3-v33m-w89f
### Summary
Missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don’t have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to access secrets in custom volumes they are not authorized to access.
### Details
The storage volume creation handler authorizes creation in the target project, then passes `req.Source.Project` into the custom-volume copy path without checking that the caller can view the source volume. `req.Source.Project` is the attacker-controlled field. It is resolved to a storage volume project name and passed directly to `CreateCustomVolumeFromCopy`. No `allowPermission` or entitlement check (e.g. `CanView` on the source volume) is performed.
From my understanding, the copy must occur on the same server. However, once the copy has been done, nothing prevents a malicious actor from moving the volume to another server.
### PoC
#### Setup
We assume the target server is remotely accessible and a user/certificate has been added.
“`
# create a new project and instance
incus project create secrets
incus profile show default | incus –project secrets edit default
incus –project secrets storage volume create default secret-vol
# restrict an existing certificate to prevent access to the project
incus config trust edit cert-fp
#>…
Source: GitHub Security Advisories · 2026-11-06