All vulnerabilities
CVE-2026-115371GHSA-x8gj-2q73-qr6j

LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys Endpoints

lxc incus
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.0.7Also 7.0.2, 7.5.0CVE List
Published22 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete objects in those buckets.

Text from CVE List

Affected versions 6

  • incusaffected: 6.0.3 before 6.0.7CVE List
  • incusunaffected: 6.0.7CVE List
  • incusaffected: 6.6.0 before 7.0.2CVE List
  • incusunaffected: 7.0.2CVE List
  • incusaffected: 7.1.0 before 7.5.0CVE List
  • incusunaffected: 7.5.0CVE List

References 2