CVE-2026-115371

Received Received - Intake

Improper Authorization in Incus Allows S3 Bucket Key Exposure

Publication date: 2026-10-22

Last updated on: 2026-10-22

Assigner: VulnCheck

Description

Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete objects in those buckets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-22

Last Modified

2026-10-22

Generated

2026-10-23

AI Q&A

2026-10-23

EPSS Evaluated

N/A

NVD

CVE-2026-115371

Affected Vendors & Products

Vendor	Product	Version / Range
lxc	incus	6.0.3
lxc	incus	6.6.0
lxc	incus	7.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

Incus versions 6.0.3 to 6.0.6, 6.6.0 to 7.0.1, and 7.1.0 to 7.4.0 have an improper authorization flaw. Restricted TLS clients can access storage bucket keys in the default project. Attackers exploit this by querying bucket keys endpoints to retrieve S3 access and secret keys, allowing them to read, modify, or delete objects in those buckets.

Detection Guidance

Check Incus logs for unauthorized access to storage bucket keys endpoints. Monitor network traffic for queries to endpoints like /1.0/storage-pools/buckets/keys. Verify user permissions for restricted TLS clients accessing default project resources.

Impact Analysis

If you use Incus with S3-compatible storage, attackers could gain unauthorized access to your data. They might steal sensitive information, alter or delete files, or disrupt services. This could lead to data breaches, financial loss, or operational downtime depending on the stored data.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's confidentiality and integrity requirements or HIPAA's safeguards for protected health information. Organizations may face fines, legal penalties, or loss of compliance certifications if breaches occur due to this flaw.

Mitigation Strategies

Upgrade Incus to versions 6.0.7, 7.0.2, or 7.5.0 or later. Restrict TLS client permissions to prevent unauthorized access to storage bucket keys. Review and audit all user permissions in the default project.

Hi! I’m here to help you understand CVE-2026-115371. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70