What’s Vulnerable › Vulnerabilities

CVE-2026-115371: LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys Endpoints

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-22 · updated 2026-10-23
• Weakness: CWE-522

Description

Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete objects in those buckets.

Affected products

• lxc incus: from 6.0.3 before 6.0.7; from 6.6.0 before 7.0.2; from 7.1.0 before 7.5.0 — fixed in 6.0.7, 7.0.2, 7.5.0

How to fix

Upgrade to a fixed version: lxc incus 6.0.7, 7.0.2, 7.5.0. Check the vendor advisory for mitigations.

References

• https://github.com/lxc/incus/security/advisories/GHSA-x8gj-2q73-qr6j
• https://www.vulncheck.com/advisories/lxc-incus-6.0.3-before-6.0.7-6.6.0-before-7.0.2-and-7.1.0-before-7.5.0-bucket-credential-disclosure-via-storage-bucket-keys-endpoints

Get alerted when CVE-2026-115371 or the next vulnerability affects your stack