{"id":"CVE-2026-115371","kind":"vulnerability","aliases":["CVE-2026-115371"],"related":[],"title":"Incus: restricted TLS clients can read storage bucket S3 keys","description":"Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete objects in those buckets.","summary":"Incus versions before 6.0.7, 7.0.2 and 7.5.0 let restricted TLS clients query the bucket keys endpoints in the default project. An attacker who obtains those keys gets S3 access and secret keys and can read, modify or delete objects in the buckets.","severity":"high","cvss":7.1,"epss":0.00219,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["incus","infrastructure","s3","self-hosted","storage"],"not_affected_if":["no-restricted-tls-clients","no-storage-buckets","patched-release"],"how_to_check":"- Run `incus version` on each Incus host and compare against `6.0.7`, `7.0.2` and `7.5.0` for the matching release line\n- Check whether any restricted TLS client certificates exist with `incus config trust list`\n- Check whether storage buckets exist in the default project with `incus storage bucket list default`","fix":"- Upgrade Incus to `6.0.7`, `7.0.2` or `7.5.0` depending on the release line in use\n- Rotate S3 access and secret keys for any storage bucket in the default project if exposure is possible\n- Revoke or review restricted TLS client certificates that do not need bucket access","status":"open","published_at":"2026-10-22T19:17:43+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T03:31:28+00:00","updated_at":"2026-10-25T03:31:28+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-25T03:31:28Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Incus to `6.0.7`, `7.0.2` or `7.5.0` depending on the release line in use\n- Rotate S3 access and secret keys for any storage bucket in the default project if exposure is possible\n- Revoke or review restricted TLS client certificates that do not need bucket access","reach":"network","title":"Incus: restricted TLS clients can read storage bucket S3 keys","impact":"high","summary":"Incus versions before 6.0.7, 7.0.2 and 7.5.0 let restricted TLS clients query the bucket keys endpoints in the default project. An attacker who obtains those keys gets S3 access and secret keys and can read, modify or delete objects in the buckets.","category":"infrastructure","nicknames":[],"who_cares":["incus","self-hosted","s3","storage"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads, modifies or deletes bucket objects using stolen S3 keys","analyst_note":"Confirm the exact fixed version per release line and whether the default project alone is affected, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115371.","how_to_check":"- Run `incus version` on each Incus host and compare against `6.0.7`, `7.0.2` and `7.5.0` for the matching release line\n- Check whether any restricted TLS client certificates exist with `incus config trust list`\n- Check whether storage buckets exist in the default project with `incus storage bucket list default`","needs_analyst":true,"not_affected_if":["patched-release","no-storage-buckets","no-restricted-tls-clients"],"who_is_affected":"Hosts running Incus 6.0.3 to before 6.0.7, 6.6.0 to before 7.0.2, or 7.1.0 to before 7.5.0 that have storage buckets in the default project and expose the Incus API over TLS to restricted clients. Deployments without storage buckets or without remote TLS clients are less exposed. Teams on patched releases can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000711,"input_tokens":3410,"output_tokens":740,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115371':13A,16A '-2026':12A,15A '6.0.3':67C '6.0.7':27B,69C '6.6.0':70C '7.0.2':28B,72C '7.1.0':74C '7.5.0':30B,76C 'access':52B,106C 'allow':83C 'attack':45B,96C 'author':80C 'bucket':8A,37B,65B,90C,100C,118C 'client':4A,34B,86C 'contain':77C 'cve':11A,14A 'default':42B,94C 'delet':61B,114C 'endpoint':39B,102C 'get':50B 'host':22B 'improp':79C 'incus':1A,17B,24B,66C 'infrastructur':18B 'key':10A,38B,49B,55B,91C,101C,109C 'let':31B 'modifi':59B,112C 'object':62B,115C 'obtain':47B,104C 'project':43B,95C 'queri':35B,98C 'read':6A,58B,88C,111C 'restrict':2A,32B,84C 's3':9A,19B,51B,105C 'secret':54B,108C 'self':21B 'self-host':20B 'storag':7A,23B,89C 'tls':3A,33B,85C 'version':25B 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Hosts running Incus 6.0.3 to before 6.0.7, 6.6.0 to before 7.0.2, or 7.1.0 to before 7.5.0 that have storage buckets in the default project and expose the Incus API over TLS to restricted clients. Deployments without storage buckets or without remote TLS clients are less exposed. Teams on patched releases can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115371","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115371","severity":null,"published_at":"2026-10-22T19:17:43+00:00","modified_at":"2026-10-23T17:06:36+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115371","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115371","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}