Aller au contenu
en Se connecter
7.0 Élevée

CVE-2026-115373 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET…

Description

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients read operations in other projects. Attackers holding a restricted certificate and a known operation UUID can retrieve command lines, environment secrets, websocket secrets, and trust enrolment tokens.

Produits et versions touchés

Produit Versions touchées Corrigé en
incus 7.5 premières → < 7.5.0 7.5.0
incus 7.1 7.1.0 → < 7.5.0 7.5.0
incus 7.0 premières → < 7.0.2 7.0.2
incus 6.1 6.1.0 → < 7.0.2 7.0.2
incus 6.0 premières → < 6.0.7 6.0.7

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de incus

Les 47 CVE de incus →
CVE-2026-115378 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in… 6.9 Moyenne CVE-2026-115377 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that… 9.4 Critique CVE-2026-115376 Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows… 8.3 Élevée CVE-2026-115375 Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes 9.4 Critique
Suivre cette CVE