PT-2026-121549
CVE-2026-115371
·
Published
2026-10-22
·
Updated
2026-10-22
Description by
CVSS 4.0
7.1
HighMetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Incus versions 6.0.3 through 6.0.6
Incus versions 6.6.0 through 7.0.1
Incus versions 7.1.0 through 7.4.9
Description
An improper authorization issue allows restricted TLS clients to read storage bucket keys within the default project. By querying the bucket keys endpoints, attackers can obtain S3 access and secret keys, enabling them to read, modify, or delete objects stored in those buckets.
Recommendations
Update Incus versions 6.0.3 through 6.0.6 to version 6.0.7.
Update Incus versions 6.6.0 through 7.0.1 to version 7.0.2.
Update Incus versions 7.1.0 through 7.4.9 to version 7.5.0.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾