Live › vulnerability › CVE-2026-115371
Go to dashboardIncus versions before 6.0.7, 7.0.2 and 7.5.0 let restricted TLS clients query the bucket keys endpoints in the default project. An attacker who obtains those keys gets S3 access and secret keys and can read, modify or delete objects in the buckets.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Hosts running Incus 6.0.3 to before 6.0.7, 6.6.0 to before 7.0.2, or 7.1.0 to before 7.5.0 that have storage buckets in the default project and expose the Incus API over TLS to restricted clients. Deployments without storage buckets or without remote TLS clients are less exposed. Teams on patched releases can skip it.
No product ranges from the sources yet.
incus version on each Incus host and compare against 6.0.7, 7.0.2 and 7.5.0 for the matching release lineincus config trust listincus storage bucket list default6.0.7, 7.0.2 or 7.5.0 depending on the release line in useEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete objects in those buckets.
This page as .md · .json · in your agent: get_signal("CVE-2026-115371")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.