CVE-2026-115371 lxc CVE debrief

Who should care

Defenders responsible for LXC Incus deployments, specifically those using versions 6.0.3, 6.6.0, or 7.1.0, should assess exposure and prioritize verification and remediation. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Defenders should also verify the existence of affected product deployments in managed environments and assign an owner for follow-up.

Why it matters

CVE-2026-115371 LXC Incus vulnerability allows restricted TLS clients to read storage bucket keys, potentially leading to unauthorized access and data breaches. Defenders should prioritize verification, remediation, and restricted access to mitigate risks.

• Potential unauthorized access to storage buckets
• Possible data breaches or modifications
• Required verification of affected versions and remediation
• Need for restricted access to storage bucket keys endpoints

Technical summary

LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. This vulnerability can be exploited by querying the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete objects in those buckets. The vulnerability is caused by an improper authorization issue in the storage bucket keys endpoints. Defenders should prioritize verifying and upgrading to fixed versions of LXC Incus, specifically 6.0.7, 7.0.2, or 7.5.0, and restrict access to storage bucket keys endpoints.

Defensive priority

Defenders should prioritize verifying and upgrading to fixed versions of LXC Incus, specifically 6.0.7, 7.0.2, or 7.5.0, and restrict access to storage bucket keys endpoints.

Recommended defensive actions

• Verify and upgrade to fixed versions of LXC Incus
• Restrict access to storage bucket keys endpoints
• Monitor for suspicious activity on storage buckets
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and references to vendor advisories. The vulnerability is confirmed to exist in LXC Incus versions 6.0.3, 6.6.0, and 7.1.0. Defenders should verify the existence of affected product deployments in managed environments and review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. The source confidence is limited to the information provided in the CVE record and source item. Additional verification

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.