CVE-2026-115370

Name of the Vulnerable Software and Affected Versions Incus versions 6.0.5 through 6.0.6 Incus versions 6.12.0 through 7.0.1 Incus versions 7.1.0 through 7.4.9

Description A restriction bypass allows restricted project users to utilize pull mode migration through clustered refresh requests. An attacker with instance creation rights can send a refresh migration request for an existing instance, forcing the server to open outbound TLS websocket connections to probe reachable services.

Recommendations Update Incus versions 6.0.5 through 6.0.6 to version 6.0.7. Update Incus versions 6.12.0 through 7.0.1 to version 7.0.2. Update Incus versions 7.1.0 through 7.4.9 to version 7.5.0.