Live › vulnerability › CVE-2026-115373
Go to dashboardIncus fails to check project authorization on GET /1.0/operations/{uuid}, so a project-restricted client that knows an operation UUID can fetch it. The response can expose command lines, environment secrets, websocket secrets and trust enrolment tokens.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Incus with project-restricted client certificates in multi-project setups are exposed, because the flaw lets those clients see operations belonging to other projects. Single-project installs or setups where all clients are unrestricted are less exposed. The sources do not say whether default configurations use restricted certificates.
No product ranges from the sources yet.
incus version or incus --version and compare against the fixed versions listed in the fix field.incus auth identity list (unknown if the sources do not say this command applies).6.0.7 or later, Incus 6.1 to 7.0.2 or later, and Incus 7.1 to 7.5.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients read operations in other projects. Attackers holding a restricted certificate and a known operation UUID can retrieve command lines, environment secrets, websocket secrets, and trust enrolment tokens.
This page as .md · .json · in your agent: get_signal("CVE-2026-115373")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.