Live › vulnerability › CVE-2026-115370
Go to dashboardRestricted project users in Incus, a container and VM manager, can abuse clustered refresh requests to switch on pull mode migration. An attacker with instance creation rights can then make the server open outbound TLS websocket connections and probe services it can reach.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Clusters and servers running Incus 6.0.5 through 6.0.6, 6.12.0 through 7.0.1, or 7.1.0 through 7.4.x are exposed when restricted projects let users create instances. Single-user hosts without restricted projects, or where only trusted administrators can create instances, carry much less risk.
No product ranges from the sources yet.
incus version on each Incus server or cluster member and compare against the fixed releases.incus project list and whether users in them can create instances.6.0.7 or later.7.0.2 or later.7.5.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an existing instance to make the server open outbound TLS websocket connections and probe reachable services.
This page as .md · .json · in your agent: get_signal("CVE-2026-115370")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.