CVE-2026-115373

Name of the Vulnerable Software and Affected Versions Incus versions prior to 6.0.7 Incus versions 6.1.0 through 7.0.1 Incus versions 7.1.0 through 7.4.9

Description An authorization flaw exists in the 'GET /1.0/operations/{uuid}' endpoint. This allows clients restricted to a specific project to access operation details from other projects. An attacker with a restricted certificate and a known uuid can retrieve sensitive information, including command lines, environment secrets, websocket secrets, and trust enrolment tokens.

Recommendations Update Incus to version 6.0.7 or later. Update Incus to version 7.0.2 or later. Update Incus to version 7.5.0 or later.