CVE-2026-115370 lxc CVE debrief

Who should care

Defenders responsible for Incus deployments, particularly those with restricted project users or instance creation rights, should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-115370 is a medium-severity vulnerability affecting Incus versions 6.0.5, 6.12.0, and 7.1.0. Attackers with instance creation rights can exploit this vulnerability to make the server open outbound TLS websocket connections and probe reachable services. Defenders should prioritize verifying and upgrading to unaffected Incus versions.

• Verify and upgrade to unaffected Incus versions to prevent exploitation.
• Restrict instance creation rights to minimize the attack surface.
• Monitor outbound TLS websocket connections for suspicious activity.

Technical summary

The vulnerability allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an existing instance to make the server open outbound TLS websocket connections and probe reachable services. This vulnerability affects Incus versions 6.0.5, 6.12.0, and 7.1.0, and defenders should prioritize verifying and upgrading to unaffected Incus versions to prevent exploitation. The vulnerability can be mitigated by restricting instance creation rights and monitoring outbound TLS websocket connections for suspicious activity.

Defensive priority

Defenders should prioritize verifying and upgrading to unaffected Incus versions.

Recommended defensive actions

• Verify Incus versions and upgrade to unaffected versions (6.0.7, 7.0.2, or 7.5.0) if necessary.
• Restrict instance creation rights to minimize the attack surface.
• Monitor outbound TLS websocket connections for suspicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an existing instance to make the server open outbound TLS websocket connections and probe reachable services.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.