7.1 High

CVE-2026-115371 LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys Endpoints

Description

Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete objects in those buckets.

CVSS 4.0 detail

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Exploitable remotely over the network, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: Low
Interaction: None
Confidentiality: High
Integrity: Low
Availability: None
Confidentiality of other systems: None
Integrity of other systems: None
Availability of other systems: None

Affected products and versions

Product	Affected versions	Fixed in
incus 7.5	earliest → < 7.5.0	7.5.0
incus 7.1	7.1.0 → < 7.5.0	7.5.0
incus 7.0	earliest → < 7.0.2	7.0.2
incus 6.6	6.6.0 → < 7.0.2	7.0.2
incus 6.0	6.0.3 → < 6.0.7	6.0.7

References

Timeline

Published October 22, 2026
Last modified November 5, 2026

The 47 CVEs of incus →

CVE-2026-115378 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in… 6.9 Medium CVE-2026-115377 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that… 9.4 Critical CVE-2026-115376 Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows… 8.3 High CVE-2026-115375 Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes 9.4 Critical

Track this CVE