CVE-2026-115373: Missing Authorization in lxc incus

CVE-2026-115373 is a missing authorization vulnerability in the Incus container management system affecting multiple version ranges: before 6.0.7, 6.1.0 through 7.0.1, and 7.1.0 through 7.4.9. The vulnerability exists in the GET /1.0/operations/{uuid} API endpoint, which fails to properly enforce project boundaries. As a result, an attacker with a restricted certificate and knowledge of an operation UUID can retrieve sensitive operational data from other projects, including command lines, environment secrets, websocket secrets, and trust enrolment tokens. The CVSS 4.0 base score is 7.0, indicating high severity, with network attack vector, low attack complexity, and partial privileges required.

An attacker with restricted project-level access and knowledge of a valid operation UUID can bypass authorization controls to read sensitive operational data from other projects. This includes command execution details, environment variables containing secrets, websocket authentication secrets, and trust enrolment tokens. Exposure of these secrets can lead to further compromise within the affected environment.

A fix is available in Incus versions 6.0.7, 7.0.2, and 7.5.0 and later. Users should upgrade to one of these fixed versions to remediate the vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary workarounds. Patch status is confirmed by the affected version ranges and the description of fixed versions.