CVE-2026-115371: Insufficiently Protected Credentials in lxc incus
Description
Incus versions 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contain an improper authorization vulnerability that allows restricted TLS clients to access storage bucket keys in the default project. This vulnerability enables attackers to retrieve S3 access and secret keys, potentially allowing them to read, modify, or delete objects in those buckets.
CVSS v4.0
Score 7.1high
Affected software
lxc
incus
pkg:github/lxc/incusRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-115371 is an authorization vulnerability in lxc's Incus affecting versions >=6.0.3 <6.0.7, >=6.6.0 <7.0.2, and >=7.1.0 <7.5.0. The flaw allows restricted TLS clients to query bucket key endpoints and obtain S3 access and secret keys for the default project. With these credentials, attackers can perform unauthorized operations such as reading, modifying, or deleting objects in the storage buckets.
Potential Impact
Exploitation of this vulnerability allows an attacker with restricted TLS client access to obtain sensitive S3 credentials, leading to unauthorized access and manipulation of storage bucket contents. This can result in data exposure, data loss, or data tampering within the affected storage buckets.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade Incus to versions 6.0.7 or later, 7.0.2 or later, or 7.5.0 or later to remediate this issue. Since Incus is a cloud service, the vendor manages remediation for the cloud-hosted service; users should verify with the vendor advisory for confirmation of applied fixes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-22T11:24:28.626Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Is Cloud Service
- true
Threat ID: 6ada64a24d27ba8daa755e6e
Added to database: 10/22/2026, 19:31:46 UTC
Last enriched: 10/22/2026, 20:45:17 UTC
Last updated: 10/22/2026, 21:35:26 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.