Live › vulnerability › CVE-2026-115376
Go to dashboardIncus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 let a project-restricted client copy storage volumes by omitting source.type in a crafted POST to the custom volumes endpoint. An attacker can name another project as the source and read that project's volumes, snapshots and configuration.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments running Incus 7.0.1 through 7.0.2 (exclusive) or 7.2.0 through 7.5.0 (exclusive) where some clients are restricted to a single project. Installs where every client is unrestricted or only the admin uses Incus are less exposed, since the bypass starts from a project-restricted identity.
No product ranges from the sources yet.
incus version on the Incus server and compare against the fixed releases.incus auth identity list or the project restrictions on your trust entries).7.0.2 if on the 7.0.x line, or to 7.5.0 if on the 7.2.x line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type. Attackers can send crafted POST requests to the custom volumes endpoint with a chosen source.project to copy and read other projects' volumes, snapshots, and configuration.
This page as .md · .json · in your agent: get_signal("CVE-2026-115376")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.