---
id: "CVE-2026-115371"
kind: "vulnerability"
aliases: ["CVE-2026-115371"]
title: "Incus: restricted TLS clients can read storage bucket S3 keys"
severity: "high"
cvss: 7.1
epss: 0.00219
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["incus", "infrastructure", "s3", "self-hosted", "storage"]
not_affected_if: ["no-restricted-tls-clients", "no-storage-buckets", "patched-release"]
published_at: "2026-10-22T19:17:43+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T03:31:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115371", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115371", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Incus: restricted TLS clients can read storage bucket S3 keys

Incus versions before 6.0.7, 7.0.2 and 7.5.0 let restricted TLS clients query the bucket keys endpoints in the default project. An attacker who obtains those keys gets S3 access and secret keys and can read, modify or delete objects in the buckets.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `incus version` on each Incus host and compare against `6.0.7`, `7.0.2` and `7.5.0` for the matching release line
- Check whether any restricted TLS client certificates exist with `incus config trust list`
- Check whether storage buckets exist in the default project with `incus storage bucket list default`

## Fix

- Upgrade Incus to `6.0.7`, `7.0.2` or `7.5.0` depending on the release line in use
- Rotate S3 access and secret keys for any storage bucket in the default project if exposure is possible
- Revoke or review restricted TLS client certificates that do not need bucket access

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115371
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115371

## From the sources

Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete objects in those buckets.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_